EU AI Act – Fines of up to EUR 35 Million and Obligations for Businesses in 2026

Last updated: 5 August 2026

Since 2 August 2026, the Artificial Intelligence Act (EU AI Act) has applied in full to businesses. Fines reach up to EUR 35 million or 7% of turnover, and the transparency obligations (labelling deepfakes and AI-generated text) have taken effect without postponement. Only the obligations for high-risk systems under Annexes III and I have been postponed, to 2 December 2027 and 2 August 2028 respectively. If you use AI solely for personal purposes or as an assistant at work, without publishing deepfakes or unedited AI text on matters of public interest, the Act creates no personal obligation for you.

The Artificial Intelligence Act (EU AI Act) is the world's first comprehensive law regulating the technology on a risk basis, imposing obligations not only on developers but also on companies that deploy AI for internal purposes. Non-compliance may lead to severe fines of up to EUR 35 million or 7% of worldwide turnover, and the key requirements on “AI literacy” have applied since February 2025.

What Are the Financial Penalties for Non-Compliance (Article 99)?

Regulation (EU) 2024/1689 introduces a three-tier system of administrative fines, one of the strictest in EU legislation. The amount depends on the seriousness of the infringement.

• Up to EUR 35,000,000 or 7% of total worldwide annual turnover – for engaging in prohibited practices (Article 5), such as social scoring, subliminal manipulation or biometric categorisation.
• Up to EUR 15,000,000 or 3% of total worldwide annual turnover – for breaches of the obligations for high-risk systems (such as the absence of human oversight or poor-quality data) or of the rules for general-purpose AI models.
• Up to EUR 7,500,000 or 1.5% of total worldwide annual turnover – for supplying incorrect or misleading information to the authorities.

Important for SMEs – for small and medium-sized enterprises, the lower of the two amounts (the fixed sum or the percentage) applies, whereas for large corporations the higher amount applies.

How Is Risk Classified and Which Practices Are Prohibited?

The architecture of the Act is built on risk classification. Before deploying any system, you must determine which category it falls into.

• Unacceptable risk (prohibited practices, Article 5) – includes social scoring systems, emotion recognition in the workplace or in schools, and the untargeted scraping of facial images from the internet.
• High-risk systems (Article 6 and Annex III) – systems in critical sectors such as human resources (recruitment), education, credit scoring, critical infrastructure and law enforcement.

Deployer or User – What Are the Obligations for “Internal Use”?

Many companies wrongly believe that the Act concerns only the IT sector. In reality, the AI Act introduces the concept of the deployer, which covers any organisation using AI in a professional context. Even if you do not develop the software but merely use it (for example, a SaaS solution for CV screening), you bear significant responsibility.

Key obligations of deployers (Article 26)

• Technical compliance – you must use the system strictly in accordance with the instructions for use provided by the provider.
• Human oversight – you must assign specific, competent staff to monitor the operation of the AI. They must have the authority to stop the system (a “kill switch”) if they notice anomalies or a risk of discrimination.
• Control of input data – where you control the input data, you are responsible for ensuring that it is relevant and sufficiently representative.
• Informing workers – under Article 26(7), before putting a high-risk system into service in the workplace, employers must inform workers and their representatives.
• Retention of logs – automatically generated logs must be kept for at least six months for audit purposes.

The urgent AI literacy requirement (Article 4)

Since February 2025, all deployers (including those using ChatGPT, Gemini, Claude and similar tools for business purposes) must ensure that their staff have a sufficient level of AI literacy. The aim is to avoid automation bias, that is, blind trust in machine decisions.

If You Use AI for Personal Purposes or as an Assistant at Work, Is There Anything to Worry About?

This is the question that concerns most people after the news of the Act being “postponed”. The answer depends entirely on the context of use.

Purely personal use – if you use ChatGPT, Gemini, Claude or a similar tool solely for personal purposes, the Regulation expressly does not apply to you. Under Article 2(10), it does not apply to the obligations of natural persons using AI systems in the course of a purely personal, non-professional activity.

Use as an assistant at work – if AI helps you write an email, summarise a document or research something as part of your work, this as a rule creates no personal obligation for you as an employee. You are not required to declare to clients or colleagues that you have used AI for internal productivity. The obligation to ensure sufficient AI literacy among staff rests on the employer as an organisation, not on the individual employee.

When you should nevertheless take care – the transparency obligations under Article 50 remain unchanged and apply from 2 August 2026. They concern specific, public-facing cases, not every internal use.

• Deepfakes – an AI-generated or manipulated image, audio or video resembling a real person, place or event in a way that could plausibly mislead must be labelled as artificially generated, unless it is evidently an artistic, satirical or fictional work.
• Publishing text on matters of public interest – AI-generated text on a matter of public interest published without human review must be labelled. If the text has undergone editorial review and a specific person or company takes editorial responsibility, as is the case with this article, the obligation does not apply.
• Chatbots – systems interacting directly with people must disclose expressly that the user is dealing with AI. This responsibility lies mainly with the provider.
• New prohibited practice (from 2 December 2026) – the use of AI to generate non-consensual intimate content or child sexual abuse material is now expressly a prohibited practice under Article 5, carrying the highest penalty under the Act (up to EUR 35 million or 7% of turnover).

The Commission also offers a free set of icons for the voluntary labelling of generated or manipulated content.

Who is liable for an infringement – penalties are imposed on undertakings and operators, not on natural persons in a personal capacity. An individual employee does not risk a personal fine for using AI at work. Liability rests with the employer.

When Do the Various Requirements Apply?

On 27 July 2026, Regulation (EU) 2026/1744 (the so-called “Digital Omnibus on AI”) was published in the Official Journal of the EU, postponing some of the most onerous deadlines under the AI Act. The updated timetable is as follows.

• 2 February 2025 – the prohibitions of unacceptable practices (Article 5) and the AI literacy requirements (Article 4) apply.
• 2 August 2025 – the rules for general-purpose AI models (Chapter V), the governance regime and administrative penalties apply.
• 2 August 2026 – the transparency obligations under Article 50 (labelling AI-generated content, disclosure when interacting with a chatbot and others) apply, together with the entire supervisory and enforcement framework of the Act. The European Commission's AI Office and the national authorities acquire full powers, and the EU database for AI systems becomes operational.
• 2 December 2026 – a new prohibited practice, the generation of non-consensual intimate content with AI, including child sexual abuse material, and the deadline for watermarking generative content placed on the market before 2 August 2026.
• 2 December 2027 (postponed from 2 August 2026) – the rules for stand-alone high-risk AI systems under Annex III (recruitment, credit scoring, education and others) and the resulting obligations of deployers under Article 26 apply.
• 2 August 2028 (postponed from 2 August 2027) – the rules for high-risk systems embedded in regulated products (Annex I, such as medical devices) apply.

Important – the postponement does not suspend the Act. It concerns only the specific high-risk obligations under Annexes III and I. Since 2 August 2026, the supervisory authorities have had full enforcement powers, and the transparency obligations remain unchanged.

What Is the “Compliance by Design” Strategy?

To avoid being shut out of the market and incurring fines, organisations need to build a compliance architecture resting on three pillars.

• Risk management (Article 9) – a continuous process of identifying and analysing risks throughout the life cycle.
• Data governance (Article 10) – safeguards against errors and bias in training datasets.
• Transparency and documentation – maintaining technical documentation and registering in the EU database before placing on the market.

If you run a business and want to be sure that your compliance processes are sound, our corporate law team can assist you.

Transparency note – this article was prepared with the assistance of artificial intelligence and validated by a human expert, in line with the transparency standards of the EU AI Act.