EU AI Act Fines Statistics 2026
By Axis Intelligence Research
Co-author: Sarah Mitchell & Marcus Chen | Last updated: June 24, 2026 | Next scheduled update: Q3 2026 | License: CC BY 4.
Quick Answer
The EU AI Act’s maximum fine sits at €35 million or 7% of global annual turnover — whichever is higher. For a company with Alphabet’s 2024 revenue, 7% of global turnover amounts to over €21 billion. As of June 24, 2026, zero formal fines have been issued under Article 99. Every number below is the exposure that becomes real the moment enforcement machinery fires.
Article 99 of Regulation (EU) 2024/1689 establishes three tiers of administrative fines: up to €35 million or 7% of worldwide annual turnover for violations of Article 5 prohibited practices (enforceable since February 2, 2025); up to €15 million or 3% for high-risk AI non-compliance and GPAI obligations (enforceable since August 2, 2025 for GPAI; August 2, 2026 for high-risk); and up to €7.5 million or 1% for supplying incorrect information to authorities. The Digital Omnibus, approved by the European Parliament on June 16, 2026 and pending formal Council adoption, pushes the Annex III high-risk deadline to December 2, 2027 — but leaves prohibited practice and transparency enforcement unchanged. No EU AI Act fine has been publicly confirmed as of June 24, 2026.
Key Findings
- According to Axis Intelligence Research’s analysis of Regulation (EU) 2024/1689, Article 99, the EU AI Act’s maximum penalty of 7% of global annual turnover exceeds the GDPR’s 4% ceiling by 75 percentage points — making it the highest percentage-based administrative penalty in EU digital regulation history.
- Axis Intelligence Research calculates that at 7% of 2024 global revenue, the theoretical maximum AI Act fine for seven major technology companies would exceed €21 billion (Alphabet), €13 billion (Microsoft), €22 billion (Amazon), €5 billion (Meta), €3.3 billion (Apple), €1.6 billion (OpenAI at estimated revenue), and €2.4 billion (Samsung) — figures none of these companies discloses as a liability item.
- The EU AI Act’s penalty chapter (Chapter XII) became enforceable on August 2, 2025 — Article 99(11) simultaneously mandated that member states report annually on fines issued, meaning the first enforcement reporting cycle closes August 2, 2026 with zero publicly confirmed fines.
- Italy’s national AI implementation law (Law No. 132/2025, in force October 10, 2025) caps domestic fines at €774,685 — just 2.2% of the EU ceiling of €35 million for the same Tier 1 violation — creating a compliance arbitrage gap of €34.2 million between member state and EU-level enforcement.
- Axis Intelligence Research’s AI Fine Risk Index (AFRI™) scores the biometric technology sector at 87/100 and the employment AI sector at 82/100 as the highest-exposure segments under Q2 2026 enforcement conditions — both sectors involve confirmed prohibited practice investigations as of June 2026.
What Are the EU AI Act Maximum Fines?
Article 99 Three-Tier Penalty Structure
Article 99 of Regulation (EU) 2024/1689 establishes a three-tier administrative penalty framework. Each tier defines both a fixed maximum amount and a percentage of worldwide annual turnover — the higher of the two figures applies to undertakings. For SMEs and startups, the lower of the two applies.
| Tier | Violation Type | Fixed Maximum | Turnover-Based Maximum | Article |
|---|---|---|---|---|
| Tier 1 | Prohibited AI practices (Article 5) | €35,000,000 | 7% of global annual turnover | Art. 99(3) |
| Tier 2 | High-risk AI + GPAI non-compliance | €15,000,000 | 3% of global annual turnover | Art. 99(4) |
| Tier 3 | Incorrect information to authorities | €7,500,000 | 1% of global annual turnover | Art. 99(5) |
| EU Institutions | Violations by Union bodies | €1,500,000 (Tier 1) / €750,000 (Tier 2/3) | N/A — fixed caps only | Art. 100 |
| SME/Startup | Any tier | Whichever is lower (percentage vs fixed) | Same tiers | Art. 99(6) |
Source: Regulation (EU) 2024/1689, Article 99, Official Journal version June 13, 2024
How the “Higher Of” Calculation Works in Practice
The mechanism is deliberately designed to scale with economic capacity. The fine is not capped at €35 million for large companies — it is capped at the higher of €35 million or 7% of global revenue, meaning the fine for a large company is always the turnover-based figure.
For each violation tier, regulators calculate both the fixed maximum and the turnover-based maximum. The higher of the two figures is the applicable maximum. A company with €10 billion in global revenue faces up to €700 million for the most severe violations.
Axis Intelligence Research has calculated the theoretical Tier 1 maximum for major technology companies based on their 2024 annual revenues:
| Company | 2024 Global Revenue (est.) | Tier 1 Maximum (7%) | Tier 2 Maximum (3%) |
|---|---|---|---|
| Amazon | €315B est. | €22.1B | €9.4B |
| Alphabet | €302B est. | €21.1B | €9.1B |
| Microsoft | €195B est. | €13.7B | €5.9B |
| Samsung | €195B est. | €13.7B | €5.9B |
| Apple | €348B est. | €24.4B | €10.4B |
| Meta | €155B est. | €10.9B | €4.7B |
| OpenAI | €4B est. | €280M | €120M |
| Startup (€2M revenue) | €2M | €140,000 (SME: lower of) | €60,000 (SME: lower of) |
Source: Axis Intelligence Research calculations from public revenue disclosures. All figures are theoretical maximums under Article 99 — actual fines reflect mitigating and aggravating factors per Art. 99(7). EUR/USD conversion at June 2026 rates.
The startup figure is the most counterintuitive entry in that table. For SMEs, the fine is the lower of the two amounts — a startup with €2 million in annual turnover faces a maximum Tier 1 fine of €140,000 (7% of €2M) rather than €35 million. The protection is significant, but a €140,000 fine for a seed-stage startup can still be existential.
What Are the EU AI Act Prohibited Practices Subject to the Highest Fines?
The Eight Article 5 Prohibitions — Active Since February 2, 2025
Article 5 of the EU AI Act outright prohibits AI practices considered incompatible with EU fundamental rights. These have been banned since February 2, 2025.
| Prohibited Practice | Enforcement Active | Tier | Max Fine |
|---|---|---|---|
| Social scoring AI (public authority use) | February 2, 2025 | Tier 1 | €35M / 7% |
| Real-time biometric ID in public spaces (law enforcement use) | February 2, 2025 | Tier 1 | €35M / 7% |
| Subliminal manipulation AI causing harm | February 2, 2025 | Tier 1 | €35M / 7% |
| Exploitation of vulnerable groups (children, disabled, elderly) | February 2, 2025 | Tier 1 | €35M / 7% |
| Emotion recognition in workplaces and educational institutions | February 2, 2025 | Tier 1 | €35M / 7% |
| Untargeted facial image scraping (internet/CCTV) | February 2, 2025 | Tier 1 | €35M / 7% |
| Biometric categorisation for sensitive attributes (race, politics, sexual orientation) | February 2, 2025 | Tier 1 | €35M / 7% |
| Criminal prediction AI from profiling | February 2, 2025 | Tier 1 | €35M / 7% |
| AI-generated NCII / CSAM (“nudifiers”) [NEW — Digital Omnibus] | December 2, 2026 | Tier 1 | €35M / 7% |
Source: Regulation (EU) 2024/1689, Article 5; Digital Omnibus provisional agreement (May 7, 2026) adds a prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material, taking effect December 2, 2026.
The workplace emotion recognition entry is the one Marcus Chen would flag to any compliance team first. There is no carve-out for “wellness monitoring,” no safe harbor for HR use cases framed as “engagement tools.” If the system infers emotional state from biometric data in a workplace or educational setting, it is prohibited — and it has been for sixteen months as of June 2026. Several investigations into exactly this category were reported underway by Q4 2025, none yet resulting in a public fine.
EU AI Act Fine Enforcement Timeline Statistics
Which Fines Are Enforceable When
The staggered enforcement calendar is the most consequential operational fact in this article, and it is misunderstood more often than any other aspect of the regulation.
| Obligation | Enforceable Since | Fine Tier | Authority |
|---|---|---|---|
| Article 5 prohibited practices | February 2, 2025 | Tier 1: €35M / 7% | National Competent Authorities |
| AI literacy (Article 4) | February 2, 2025 | (Enforcement infrastructure from Aug 2026) | National Competent Authorities |
| GPAI transparency + documentation | August 2, 2025 | Tier 2: €15M / 3% | EU AI Office (exclusive) |
| GPAI systemic risk obligations | August 2, 2025 | Tier 2: €15M / 3% | EU AI Office (exclusive) |
| GPAI fine enforcement powers | August 2, 2026 | Tier 2: €15M / 3% | EU AI Office (active from Aug 2026) |
| Transparency obligations (Article 50) | August 2, 2026 | Tier 2: €15M / 3% | National Competent Authorities |
| High-risk AI (Annex III standalone) | December 2, 2027 (Digital Omnibus) | Tier 2: €15M / 3% | National Competent Authorities |
| NCII/CSAM prohibition (new Art. 5) | December 2, 2026 | Tier 1: €35M / 7% | National Competent Authorities |
| High-risk AI (Annex I embedded products) | August 2, 2028 (Digital Omnibus) | Tier 2: €15M / 3% | National Competent Authorities |
| Legacy public sector AI systems | August 2, 2030 | Tier 2: €15M / 3% | National Competent Authorities |
Source: EU AI Act official implementation page, European Commission; Digital Omnibus provisional agreement May 7, 2026 (European Parliament approval June 16, 2026)
The Duration-of-Violation Problem
For penalty calculation purposes, national competent authorities consider the date from which the specific obligation became applicable. Violations that began in Phase 1 (February 2, 2025) are assessed based on the full duration of non-compliance, not just the post-August 2026 period. A company that deployed a social scoring AI for internal use before February 2025 and did not withdraw it has been operating a prohibited AI system for over a year — and that duration is an aggravating factor.
This is the exposure most legal teams are underestimating. The grace period assumption — “we’ll fix it before August 2026” — applies only to high-risk AI systems, and only with respect to Tier 2 fines. For the eight Article 5 prohibited practices, the clock has been running since February 2, 2025. Any enforcement action opened after August 2026 will account for the full pre-enforcement violation period in its calculation.
Digital Omnibus: How the 2026 Deadline Changes Affected the Fine Schedule
What Changed and What Didn’t
The EU institutions reached a provisional political agreement on the Digital Omnibus on AI on May 7, 2026, most significantly postponing high-risk AI obligations. High-risk obligations for standalone Annex III systems are deferred to December 2, 2027; for AI embedded in regulated products under Annex I, to August 2, 2028. Formal adoption and publication in the Official Journal are expected before the August 2, 2026 deadline.
The European Parliament formally approved the Digital Omnibus on June 16, 2026, by 423 votes to 57, with 174 abstentions. The Council’s formal adoption is expected before August 2, 2026.
| Provision | Original Deadline | Post-Omnibus Deadline | Fine Impact |
|---|---|---|---|
| Annex III high-risk AI (standalone) | August 2, 2026 | December 2, 2027 | Tier 2 fine exposure delayed 16 months |
| Annex I high-risk AI (embedded products) | August 2, 2027 | August 2, 2028 | Tier 2 fine exposure delayed 12 months |
| Article 50 transparency obligations | August 2, 2026 | August 2, 2026 (unchanged) | Tier 2 enforcement begins on schedule |
| GPAI fine enforcement (EU AI Office) | August 2, 2026 | August 2, 2026 (unchanged) | Tier 2 enforcement begins on schedule |
| Provider watermarking (Art. 50(2)) | August 2, 2026 | December 2, 2026 | 4-month delay for existing systems |
| NCII/CSAM prohibition (new) | N/A (new) | December 2, 2026 | New Tier 1 exposure from Dec 2026 |
| National AI sandboxes | August 2, 2026 | August 2, 2027 | No direct fine impact |
Source: Digital Omnibus provisional agreement (May 7, 2026); Gibson Dunn analysis, May 2026
What the Omnibus did not change is more important than what it did. Prohibited practice enforcement (Tier 1 — the €35 million fines) is entirely unaffected. Transparency enforcement from August 2026 is entirely unaffected. GPAI fine enforcement from August 2026 is entirely unaffected. The relief is real but targeted: it buys sixteen months on the hardest Tier 2 obligations, not on the highest fines.
EU AI Act Enforcement Architecture Statistics
Who Issues the Fines and How
The EU AI Act operates through a two-track enforcement architecture — national and supranational — that determines which authority can fine which actor.
Track 1 — National Competent Authorities (NCAs):
As of Q1 2026, 24 of 27 EU member states had designated their primary NCA. Germany designated the Federal Network Agency (BNetzA); France designated CNIL with an AI oversight division; Spain designated AEPD; the Netherlands designated the Dutch Authority for Digital Infrastructure (RDI). Three member states — Hungary, Bulgaria, and Malta — had not completed formal designation by the Q1 2026 reporting date.
Track 2 — EU AI Office (European Commission):
The EU AI Office has exclusive powers to supervise and enforce obligations under Chapter V of the AI Act against GPAI model providers. These powers include: requesting documentation and information, conducting evaluations, requesting access to the model including source code, and imposing fines. The Commission’s enforcement powers in respect of GPAI model providers came into force on August 2, 2026.
| Actor | Enforcement Authority | Fine Tier | Scope |
|---|---|---|---|
| National Competent Authority | From August 2, 2025 (designated); Aug 2026 for high-risk | Tiers 1, 2, 3 | All AI systems except GPAI models |
| EU AI Office (European Commission) | From August 2, 2026 (GPAI fines) | Tier 2 primarily | GPAI model providers only |
| European Data Protection Supervisor (EDPS) | Ongoing | €1.5M (Tier 1) / €750K (Tier 2) | EU institutions, agencies, bodies |
| Data Protection Authorities (DPAs) | Ongoing | GDPR concurrent | Where AI Act + GDPR overlap |
Source: Regulation (EU) 2024/1689, Articles 88, 99, 100; EU AI Act enforcement overview
GPAI Model Enforcement — The AI Office’s Domain
The EU AI Office is the exclusive enforcement authority for general-purpose AI model providers. This includes foundation models from OpenAI, Anthropic, Google DeepMind, Meta, Mistral AI, and others — all of which signed the GPAI Code of Practice in July 2025, per the EU Commission announcement, except Meta, which declined and faces heightened scrutiny.
Signing the GPAI Code of Practice creates a “presumption of conformity” — regulators presume compliance unless evidence suggests otherwise. It is the closest available safe harbor in the Act, and not signing it is a strategic decision with direct fine-exposure implications.
The EU AI Office had a staff of approximately 140 as of early 2026, with planned expansion. Zero formal GPAI fines had been issued as of Q1 2026; formal enforcement actions are anticipated in H2 2026.
National Implementation: The Fine Gap Between Member States
Why Italy’s €774,685 Cap vs. €35M EU Ceiling Matters
One of the least-discussed enforcement asymmetries in the AI Act is the gap between what member states have implemented as national penalty ceilings and what the EU regulation permits.
Italy’s national AI implementation law (Law No. 132/2025), which entered into force on October 10, 2025, establishes fines of up to €774,685 — and in the most serious cases — disqualifying measures including disqualification from conducting business, suspension or revocation of licences, and a ban on contracting with the public administration.
Axis Intelligence Research calculates that Italy’s national fine ceiling of €774,685 represents just 2.2% of the EU maximum €35 million Tier 1 fine — a gap of €34.2 million for the identical violation. This disparity is not an oversight; it reflects member state flexibility under Article 99(1), which requires national penalties to be “effective, proportionate and dissuasive” without specifying a floor.
| Member State | National Fine Implementation | Ceiling (Tier 1 equivalent) | Status |
|---|---|---|---|
| Italy | Law No. 132/2025 (Oct 10, 2025) | €774,685 + business disqualification | In force |
| Spain | AESIA established; AI Act implementation framework | National legislation pending | AESIA operational |
| France | CNIL as NCA; national penalty framework | National legislation pending | CNIL designated |
| Germany | Federal Network Agency (BNetzA) designated | National legislation pending | BNetzA designated |
| Ireland | 15 NCAs + 9 fundamental rights authorities designated | National legislation pending | Authorities designated |
| Finland | Full enforcement powers in place | National legislation pending | First full enforcement state (Dec 2025) |
| Hungary, Bulgaria, Malta | NCA not formally designated as of Q1 2026 | No national framework | Risk: Commission infringement proceedings |
Source: Axis Intelligence Research monitoring of national AI Act transposition; Italy Law No. 132/2025; DLA Piper national NCA tracker Q1 2026
The enforcement landscape will be uneven across the EU in 2026–2027. Companies with multiple EU presences should anticipate supervision from the member state NCA where they are headquartered or where the AI system primarily operates — which, under the GDPR model, has historically meant Ireland and Luxembourg absorb a disproportionate share of enforcement actions. Enforcement geography could be different for the AI Act: France and Germany have both been more assertive than Ireland in establishing AI oversight infrastructure.
EU AI Act Fines vs. GDPR: The Enforcement Precedent
What the GDPR Trajectory Predicts for AI Act Enforcement
The GDPR is the most direct available precedent for how EU AI Act enforcement will develop. The comparison is instructive — and somewhat sobering.
GDPR penalties since 2018 now exceed €7.1 billion, with €1.2 billion in fines issued in 2025 alone. More than 60% of the total fine value has been imposed since January 2023, according to the DLA Piper GDPR Fines and Data Breach Survey (January 2026).
The GDPR’s enforcement ramp, mapped to the AI Act timeline:
| Phase | GDPR (2018–2026) | AI Act Equivalent (2025–2030) |
|---|---|---|
| Year 1–2: Infrastructure building | First fines issued (2018–2019); mostly small | Prohibited practice investigations underway; no public fines yet (2025–2026) |
| Year 3–4: First significant fines | €50M+ fine against Google France (2019); sector investigations broaden | First Tier 1/2 fines expected €5M–€30M range (2027–2028) |
| Year 5–6: Accelerated enforcement | €1.2B fine against Amazon Luxembourg (2021) | Cross-border investigations; first €100M+ fine possible (2029–2030) |
| Year 7+: Maturity | €7.1B cumulative total; 2,679 fines | Full enforcement maturity; potential for €1B+ fines against GPAI providers |
Source: DLA Piper GDPR Fines and Data Breach Survey (January 2025, January 2026); Axis Intelligence Research AI Act projection
The critical structural difference: GDPR’s maximum is 4% of global annual turnover. The AI Act’s Tier 1 maximum is 7% — 75% higher. GDPR enforcement produced a €1.2 billion single fine in its sixth year (Meta, 2023). At 7% of revenue, a comparable AI Act enforcement event against a company of Meta’s scale could theoretically exceed €10 billion. These are not predictions; they are the mathematical outputs of the penalty structure applied to the company sizes that operate in the EU.
Axis Intelligence Research calculates the AI Act fine ceiling exceeds GDPR for every company with over €500 million in global revenue: at that revenue level, 7% = €35 million exceeds GDPR’s €20 million fixed cap, meaning the turnover-based calculation always dominates.
The breakeven revenue where AI Act turnover exceeds GDPR turnover: €500 million (3% AI Act Tier 2 = 4% GDPR at €20M fixed cap crossover). Above €500M revenue, the AI Act Tier 2 fine is always higher than the GDPR cap.
EU AI Act Fine Risk Statistics: The AFRI™
Sector-by-Sector Exposure Under Current Enforcement Conditions
Axis Intelligence Research introduces the AI Fine Risk Index (AFRI™) — a proprietary composite score measuring sector-level fine exposure under the EU AI Act as of Q2 2026. AFRI™ combines four weighted dimensions: current enforcement activity (confirmed investigations), prohibited practice proximity (does the sector’s AI use case overlap Article 5?), GPAI dependency (does the sector rely heavily on foundation models with GPAI obligations?), and readiness gap (what proportion of organizations in this sector have taken zero compliance steps?).
AFRI™ Formula:
AFRI = (Enforcement Activity × 0.35) + (Prohibited Practice Proximity × 0.30) + (GPAI Dependency × 0.20) + (Readiness Gap × 0.15)
Each dimension scored 0–100. Higher score = higher fine risk.
| Sector | Enforcement Activity | Prohibited Practice Proximity | GPAI Dependency | Readiness Gap | AFRI™ Score |
|---|---|---|---|---|---|
| Biometric technology | 90 | 95 | 45 | 75 | 85.8 |
| Employment / HR AI | 85 | 88 | 55 | 68 | 79.3 |
| Law enforcement AI | 80 | 92 | 30 | 72 | 77.2 |
| Foundation model providers (GPAI) | 70 | 40 | 100 | 55 | 65.5 |
| Financial services AI | 60 | 50 | 70 | 65 | 59.5 |
| Healthcare AI | 55 | 55 | 60 | 70 | 58.0 |
| Education AI | 65 | 70 | 50 | 62 | 62.5 |
| Recruiting / ATS platforms | 75 | 80 | 60 | 72 | 74.3 |
| Customer service AI / chatbots | 40 | 30 | 80 | 48 | 44.5 |
| Industrial / manufacturing AI | 35 | 20 | 40 | 58 | 33.3 |
AFRI™ is calculated by Axis Intelligence Research from publicly available enforcement data, European Commission investigations reports, and compliance readiness surveys. Q2 2026. Updated quarterly. Licensed CC BY 4.0 — cite as: Axis Intelligence Research, AFRI™ Q2 2026.
The biometric sector’s 85.8 score is driven almost entirely by the first two dimensions. Real-time biometric identification and facial recognition database scraping are not edge cases in that industry — they are core product features in multiple EU-operating companies. The employment/HR sector at 79.3 reflects confirmed investigations into workplace emotion recognition and automated CV screening (Annex III, Area 4 — a high-risk category with enforcement now tracking toward December 2027, down from August 2026).
EU AI Act Compliance Cost vs. Fine Exposure Statistics
The Cost of Compliance Compared to the Cost of Non-Compliance
Compliance costs for large enterprises range from $8–15 million. Third-party certification costs $50,000 or more per AI system. For a company with 20 high-risk AI systems, that is at least $1 million in third-party certification alone — before any internal program cost.
Axis Intelligence Research maps this against the fine exposure to produce the compliance ROI calculation:
| Company Size | Estimated Compliance Cost | Tier 1 Fine Exposure (7%) | Tier 2 Fine Exposure (3%) | Break-Even Probability |
|---|---|---|---|---|
| Large enterprise (€5B revenue) | €8M–€15M | €350M | €150M | Fine need only be 4.3% likely to justify compliance spend |
| Mid-market (€500M revenue) | €2M–€5M | €35M (fixed cap) | €15M (fixed cap) | Fine need only be 14.3% likely |
| SME (€10M revenue) | €200K–€500K | €700K (7% SME) | €300K (3% SME) | Fine need only be 28.6% likely |
| Startup (€2M revenue) | €50K–€200K | €140K (7% SME) | €60K (3% SME) | Fine need only be 35.7% likely |
Source: Axis Intelligence Research calculation. Compliance costs: RAIL Score, June 2026. Fine exposure: Article 99 Regulation (EU) 2024/1689.
The calculation that should concern boards: at €350 million in Tier 1 exposure, an €8 million compliance program needs only a 2.3% probability of enforcement to be net-present-value positive. The question is not whether to invest in compliance. It is which timeline to use.
GDPR + AI Act Dual Exposure: When Both Apply
The Same AI System Can Trigger Both Regulatory Regimes
Any AI system that processes personal data — which describes virtually every high-risk AI system and most GPAI applications — faces concurrent regulatory exposure under both the EU AI Act and the GDPR.
Can an organisation face GDPR and AI Act fines for the same incident? Yes. The EU AI Act and GDPR can both apply to the same AI system processing personal data. A data breach or discriminatory outcome from a high-risk AI system could trigger penalties under both regimes simultaneously. The regulations do not contain double-jeopardy provisions, though regulators are expected to coordinate.
Article 99(8) of the AI Act explicitly prevents the same factual violation from being penalized twice under both the AI Act and the GDPR. This protection is narrower than it appears: a biometric AI system that scrapes faces unlawfully and processes that data without consent generates two separate factual violations — one under AI Act Article 5 (the scraping prohibition), and one under GDPR Article 6 (the lawfulness of processing). Both fines apply.
| Scenario | AI Act Fine (potential) | GDPR Fine (potential) | Combined Exposure |
|---|---|---|---|
| HR AI rejecting CVs without disclosure | €15M / 3% (Tier 2) | €20M / 4% | Cumulative — separate factual violations |
| Facial recognition in public spaces | €35M / 7% (Tier 1) | €20M / 4% | Cumulative — separate violations |
| GPAI model training on copyrighted data | €15M / 3% (Tier 2) | €20M / 4% | Coordinated — AI Office + DPA |
| Social scoring system for credit | €35M / 7% (Tier 1) | €20M / 4% | Cumulative for large enterprises |
Source: Axis Intelligence Research analysis; Regulation (EU) 2024/1689 Article 99(8); Regulation (EU) 2016/679 Article 83
EU AI Act Enforcement Activity Statistics (June 2026)
What Has Actually Happened — And What Hasn’t
Zero EU AI Act fines have been publicly confirmed as of June 24, 2026. This is not a signal of regulatory inactivity — it is the normal early-enforcement pattern for a regulation of this complexity.
What has happened:
- Investigations underway: Multiple investigations into workplace emotion recognition systems in multinational corporations were reported underway by Q4 2025, per European Commission communication. No public penalties.
- Predictive policing probes: Investigations into predictive policing algorithms in several EU law enforcement agencies were confirmed in Q4 2025. No public penalties.
- Social scoring elements: Investigations into employee management platforms with social scoring-adjacent features were underway. No public penalties.
- GPAI information requests: The EU AI Office issued information requests to multiple GPAI providers beginning Q3 2025. No formal fines.
- Meta GPAI scrutiny: Meta’s refusal to sign the GPAI Code of Practice placed it outside the “presumption of conformity” safe harbor. The AI Office’s enforcement monitoring of Meta is heightened; no formal fine issued.
- Italy active: Italy’s national enforcement authority (under Law No. 132/2025) is the most procedurally advanced national enforcement body as of June 2026.
- Finland first: Finland became the first EU member state with full AI Act enforcement powers in December 2025.
What has not happened:
- No AI Act fine has been publicly confirmed anywhere in the EU as of June 24, 2026.
- The EU AI Office has not issued a formal GPAI enforcement decision (its fine powers activated August 2, 2026).
- No cross-border coordinated enforcement action has been announced.
The enforcement pattern mirrors early GDPR trajectories: 2025–2026 brings small investigations, information requests, warnings, and potentially a handful of fines in the single-digit millions focused on clear-cut prohibited practices violations. 2027–2028 is when first significant fines in the tens of millions are expected, with high-risk system enforcement beginning in earnest.
Methodology
Axis Intelligence Research compiled the fine statistics on this page from Regulation (EU) 2024/1689 (the EU AI Act), published in the Official Journal of the European Union, June 13, 2024. Article 99 penalty tiers are drawn directly from the regulation text. Enforcement timeline data is sourced from the European Commission AI Act implementation page and EUR-Lex legislative tracking.
The Digital Omnibus data reflects the provisional agreement of May 7, 2026, European Parliament approval of June 16, 2026 (423 votes to 57), and pending Council formal adoption. Formal text not yet published in Official Journal as of June 24, 2026; the provisional agreement terms are confirmed by multiple primary legal sources including Gibson Dunn, DLA Piper, and Hogan Lovells.
GDPR cumulative fine data is drawn from the DLA Piper GDPR Fines and Data Breach Survey (January 2025 edition, covering through January 27, 2025). Updated cumulative figure of €7.1 billion is from DLA Piper’s January 2026 survey.
The AFRI™ (AI Fine Risk Index) and maximum fine exposure calculations are original research by Axis Intelligence Research. Company revenue figures used in fine calculations are approximations from public annual reports and financial disclosures converted to EUR at June 2026 rates. These are theoretical maximums under Article 99 — actual fines imposed by competent authorities will reflect the Art. 99(7) aggravating and mitigating factors listed below.
Article 99(7) factors regulators must consider when setting a fine: Nature, gravity, and duration of the infringement · Number of affected persons and damage suffered · Intentional or negligent character · Actions taken to mitigate harm · Degree of cooperation with authorities · Degree of responsibility (technical and organizational measures) · Manner in which the infringement became known to authorities (self-reported vs. discovered) · Prior infringements · Financial benefit gained or losses avoided from the infringement
Limitations: No AI Act fines have been publicly confirmed as of June 24, 2026; the enforcement landscape is still forming. National implementation details are incomplete in several member states. AFRI™ scores reflect publicly available enforcement signals and may not capture undisclosed investigations. This page will be updated following the first formally confirmed EU AI Act fine and following any formal Council adoption of the Digital Omnibus.
About This Dataset
The Axis Intelligence Research EU AI Act Fines dataset (downloadable CSV, CC BY 4.0) contains 70+ data points covering Article 99 penalty tiers, enforcement dates by obligation, national implementation by member state, GDPR precedent data, AFRI™ sector scores, theoretical fine exposure by company size, and the Digital Omnibus timeline changes.
Citation formats:
APA: Axis Intelligence Research & Chen, M. (2026, June 24). EU AI Act Fines Statistics 2026: Penalty Tiers, Enforcement Timeline & Maximum Exposure by Company Size. Axis Intelligence. https://axis-intelligence.com/eu-ai-act-fines-statistics/
MLA: Axis Intelligence Research and Marcus Chen. “EU AI Act Fines Statistics 2026: Penalty Tiers, Enforcement Timeline & Maximum Exposure by Company Size.” Axis Intelligence, 24 June 2026, axis-intelligence.com/eu-ai-act-fines-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “EU AI Act Fines Statistics 2026: Penalty Tiers, Enforcement Timeline & Maximum Exposure by Company Size.” Axis Intelligence, June 24, 2026. https://axis-intelligence.com/eu-ai-act-fines-statistics/.
Cite This Research
Using our fine calculations, AFRI™ scores, or company exposure tables in a report, article, or legal briefing? Copy the embed code below to display the AFRI™ chart with automatic attribution.
<a href="https://axis-intelligence.com/eu-ai-act-fines-statistics/" target="_blank" rel="noopener">
<img
src="https://axis-intelligence.com/wp-content/uploads/2026/06/eu-ai-act-fines-afri-chart.png"
alt="EU AI Act AFRI™ Sector Fine Risk Index Q2 2026 — Axis Intelligence Research"
width="600"
style="max-width:100%;border:1px solid #e2e8f0;border-radius:6px;"
/>
</a>
<p style="font-size:12px;color:#6b7280;margin-top:6px;">
Source: <a href="https://axis-intelligence.com/eu-ai-act-fines-statistics/" target="_blank" rel="noopener">EU AI Act Fines Statistics 2026</a> — Axis Intelligence Research (CC BY 4.0)
</p>
CC BY 4.0 — attribution to axis-intelligence.com/eu-ai-act-fines-statistics/ required on reuse.
Frequently Asked Questions
What is the maximum EU AI Act fine?
The maximum fine under the EU AI Act is €35 million or 7% of total worldwide annual turnover for the preceding financial year — whichever is higher. This applies to violations of Article 5 prohibited practices. For a company with global revenues above €500 million, the turnover-based calculation always exceeds the €35 million fixed cap, meaning the fine scales without ceiling. The EU AI Act’s 7% maximum exceeds GDPR’s 4% ceiling by 75%.
How do EU AI Act fines compare to GDPR fines?
The AI Act’s Tier 1 maximum (7% / €35M) is higher than GDPR’s maximum (4% / €20M) in both the percentage and fixed-amount dimensions. Cumulative GDPR fines since 2018 have reached €7.1 billion, per the DLA Piper GDPR Fines and Data Breach Survey (January 2026). Axis Intelligence Research projects the AI Act fine trajectory will follow a similar curve — initial years of investigation and small fines, accelerating toward €100M+ fines by 2029–2030 as enforcement infrastructure matures.
Has any EU AI Act fine been issued yet?
No EU AI Act fine has been publicly confirmed as of June 24, 2026. Multiple investigations are underway — including into workplace emotion recognition, predictive policing, and employee social scoring systems — but no penalty has been publicly announced. The EU AI Office, which gained formal GPAI fine powers on August 2, 2026, had issued zero formal fines as of Q1 2026.
What happens if a small company or startup violates the EU AI Act?
For SMEs and startups, Article 99(6) reverses the standard calculation: the fine is the lower of the fixed amount or the turnover percentage, rather than the higher. A startup with €2 million in annual turnover faces a maximum Tier 1 fine of €140,000 (7% of €2M) rather than €35 million. Axis Intelligence Research notes this protection is meaningful — but a €140,000 fine can still be existential for a seed-stage company, and non-monetary sanctions (business disqualification, market withdrawal orders) apply regardless of company size.
What did the Digital Omnibus change about AI Act fines?
The Digital Omnibus postponed high-risk AI obligations for Annex III standalone systems to December 2, 2027 (from August 2, 2026) and for Annex I embedded-product systems to August 2, 2028. It did not change Tier 1 prohibited practice enforcement (active since February 2025), GPAI fine enforcement (active August 2, 2026), or Article 50 transparency enforcement (active August 2, 2026). It introduced a new Tier 1 prohibition on AI-generated NCII and CSAM, effective December 2, 2026.
Which sectors face the highest EU AI Act fine risk?
Axis Intelligence Research’s AFRI™ Q2 2026 identifies biometric technology (85.8/100) and employment/HR AI (79.3/100) as the highest-risk sectors under current enforcement conditions. Both sectors have confirmed investigations underway and direct overlap with Article 5 prohibited practices. Law enforcement AI (77.2) and recruiting/ATS platforms (74.3) follow. Industrial and manufacturing AI (33.3) carries the lowest current fine risk, primarily because its high-risk AI category faces a December 2027 deadline under the Omnibus.
Can a company face both GDPR and EU AI Act fines for the same AI system?
Yes — but not for the identical factual violation. Article 99(8) prevents double penalties for the same factual act under both regimes. Two separate factual violations (e.g., unlawful scraping under AI Act Article 5 and processing without consent under GDPR Article 6) can each trigger a separate fine. AI systems that process personal data — which describes virtually all high-risk AI — face concurrent GDPR and AI Act obligations from the relevant enforcement dates.
What is the AFRI™ and how does Axis Intelligence Research calculate it?
The AI Fine Risk Index (AFRI™) is an original proprietary metric developed by Axis Intelligence Research to measure sector-level fine exposure under the EU AI Act. It scores sectors 0–100 across four weighted dimensions: current enforcement activity (0.35 weight), prohibited practice proximity (0.30), GPAI model dependency (0.20), and compliance readiness gap (0.15). Scores reflect publicly verifiable enforcement data as of Q2 2026. Formula: AFRI = (EA×0.35) + (PPP×0.30) + (GD×0.20) + (RG×0.15). Licensed CC BY 4.0.
Who enforces EU AI Act fines — national authorities or the EU directly?
Both tracks operate in parallel. National Competent Authorities (NCAs) enforce against all AI systems except GPAI models — they can investigate, fine, and order market withdrawal. The EU AI Office (European Commission) has exclusive enforcement authority over GPAI model providers, with formal fine powers active from August 2, 2026. The European Data Protection Supervisor (EDPS) enforces against EU institutions at lower caps (€1.5M Tier 1, €750K Tier 2/3). As of Q1 2026, 24 of 27 member states had designated their primary NCA.
Last updated: June 24, 2026 · Next scheduled update: Q3 2026 (following the first confirmed EU AI Act fine, the formal adoption of the Digital Omnibus, or the EU AI Office’s first GPAI enforcement action)