What's the maximum EU AI Act fine?
€35M or 7% of total worldwide annual turnover (whichever is higher) for using a prohibited AI practice listed in Article 5. This is HIGHER than the GDPR maximum (4% / €20M) — the EU AI Act is the most aggressive AI regulation in the world by penalty ceiling.
When do EU AI Act fines start?
Article 5 prohibitions and Article 99 fines for those prohibitions began 2 February 2025. General-purpose AI obligations and the bulk of high-risk system obligations (and corresponding fines) phase in by 2 August 2025 and 2 August 2026, with full applicability for high-risk systems already on the market by 2 August 2027.
Does the EU AI Act apply to my US company?
Yes if you place an AI system on the EU market, put it into service in the EU, or if outputs are used in the EU. Article 2(1)(c) catches non-EU providers and deployers — the same extraterritoriality model GDPR uses. Most US SaaS with EU users is in scope.
Are SMEs treated differently?
Yes. Under Article 99(6), for SMEs (including start-ups) the lower of the two amounts (fixed cap OR percentage of turnover) applies — opposite of the standard rule. This protects small EU companies from disproportionate fines while still binding them to the substantive rules.
What counts as a prohibited AI practice?
Article 5 prohibits: subliminal manipulation, exploitation of vulnerabilities (age, disability, socio-economic), social scoring by public authorities, real-time remote biometric identification in public spaces (with narrow law-enforcement exceptions), predictive-policing profiling, untargeted facial-image scraping for databases, emotion recognition in workplaces/education, and biometric categorisation inferring race/political/religion/sexual-orientation. These trigger the €35M / 7% cap.