Article 99 of the Regulation sets the fine tiers. Crucially, fines are calculated as "whichever is higher" between the cap and a percentage of the offender's total worldwide annual turnover for the preceding financial year. For SMEs and start-ups, Article 99(6) caps the fine at whichever is lower — a small but meaningful relief.
The three tiers
Up to €35M / 7%
Prohibited practices (Art. 5)
Manipulative or exploitative AI, social scoring, real-time remote biometric ID in public spaces (with narrow law-enforcement carve-outs).
Up to €15M / 3%
Obligation breaches (most of the Act)
Failure to comply with provider obligations (Art. 16), conformity assessment (Art. 43), post-market monitoring (Art. 72), serious-incident reporting (Art. 73), transparency (Art. 50).
Up to €7.5M / 1%
Misleading information to authorities
Supplying incorrect, incomplete, or misleading information to notified bodies or competent authorities (Art. 99(5)).
Who enforces it?
Each Member State designates a national competent authority. The EU AI Office, sitting within the Commission, handles GPAI obligations directly. The European AI Board coordinates across Member States.
What counts as "global annual turnover"?
Group turnover — not the legal entity that operated the system. If you're a subsidiary of a €5B group, your 7% cap is €350M, not 7% of the subsidiary's revenue.