Your AI Fine: 3%, Not 35 Million

The big picture:

What strikes me is that the tiers follow the duty, not the damage. The fine rules set three of them, and each asks for the higher of a flat sum or a share of global sales [1]. Read that way, the table is not a ladder of severity. It is a map of which obligation the regulator thought a firm could not be trusted to keep.

Rule broken	Sales share	Flat amount
Banned uses (Article 5)	7%	€35 million
Deployer duties (Article 26), disclosure (Article 50)	3%	€15 million
Wrong answers to a watchdog	1%	€7.5 million

A deployer is the firm that puts an AI system to work. That is usually the buyer, not the maker. That distinction is why the €35 million figure misleads a bank. The figure belongs to a closed list of banned uses. A bank running a credit model is not on that list, so its own arithmetic starts at €60 million instead: the deployer band is where it sits [1]. It sits one tier down, which is why its own arithmetic starts at €60 million instead.

The clock matters as much as the tiers, and it runs in an odd order. The fine chapter has applied since 2 August 2025, and the bans since 2 February 2025 [2]. Two more bans arrive on 2 December 2026. The high-risk duties start later still, and they generate most of a governance program’s work. The dates are 2 December 2027 for systems listed in Annex III, and 2 August 2028 for products covered through Annex I [2].

In other words, Europe built the fine before it switched on the duties. A firm can already be fined for a duty it has not yet had to perform in full. That gap between the fine and the duty is what makes the early exposure hard to plan for.

“Whichever is higher” is the phrase that moves the number. Below €500 million of sales the euro figure caps a firm, and above it the share runs. A separate rule for small firms pushes the same logic from the other side. It caps a small or medium-sized firm at the lower of the two [1]. The regime is drawn so the cash follows the balance sheet. Two firms that fail in identical ways can therefore owe wildly different amounts, for reasons that have nothing to do with the failure.

By the numbers

• 3% — Deployer band: a deployer’s duties under Article 26 and the Article 50 rule on telling users what they face sit in the band of up to €15 million or 3% of global sales, whichever is higher [1].
• 7% — Banned uses only: the €35 million figure attaches to Article 5’s closed list, not to the wider duty to run a system safely [1].
• €500 million — Crossing point: the sales level at which 3% passes €15 million and 7% passes €35 million, so the flat amounts stop binding (sums worked out from [1]).
• 4% — Privacy band: a personal-data breach tied to the same system can reach €20 million or 4% of global sales, whichever is higher, under a rulebook the AI Act leaves alone [5][4].

What I’d watch:

My read is that the budget talk changes shape once the number is worked out rather than quoted. At €2 billion of sales the three bands read €140 million, €60 million and €20 million. The privacy band reads €80 million (sums worked out from [1] and [5]). None of those totals needs a watchdog to have decided anything, because they are what the text says the top is. What they do need is someone in finance willing to put a range on a board slide. A single number lifted from a summary will not do.

• The arithmetic reaching finance. A mid-sized firm below €500 million of sales still runs into the flat figures. The quoted headline is its real ceiling, not a smaller number [1].
• The two bans arriving on 2 December 2026. The amended application clause pushes points (ba) and (bb) of the banned list to that date. The closed list the 7% band hangs on is still growing [2].
• Model providers on the same share. The European Commission can fine a maker of a general-purpose model up to 3% of yearly global sales, or €15 million, the larger of the two [3]. A group that ships its own model meets the same 3% from a second side.
• The privacy reading running alongside. Article 2 says the AI Act does not affect the General Data Protection Regulation (GDPR) [4]. That is how one incident gets priced twice, once at 3% and once at 4% [1][5]. The two shares are not added together. They are two readings of one breach.
• The record the duty rests on. A deployer’s duties include watching the system run, assigning human oversight and keeping the system’s own logs for at least six months [6]. An agent’s logs are only evidence if they can be replayed. That is where a 3% exposure is usually found: not in the model’s answer, but in whether anyone can show what it answered.

The catch

The part I keep circling is that these bands are tops rather than prices. The rules tell a national watchdog to weigh four things before it sets an exact amount. They are the nature, gravity and length of the breach, any earlier fines, and the size and sales of the firm [1]. Member states write the process rules themselves, and no case has yet shown how that discretion gets used [1]. I have not read a single decided case against these tiers, because there is not one to read yet.

Two limits hold, and both cut against the dramatic reading. Below €500 million of sales the euro figure really is the top. A mid-sized firm quoting €15 million is quoting its own number, not a smaller one. A share of sales also measures the firm rather than the harm. The same breach costs a big group more than a small one, for reasons that have nothing to do with the agent.

Where I have landed is that the honest board figure is a range, with the crossing point written beside it. It is not one number lifted from a summary. The text is short, and the sums take a minute. That is cheaper than the alternative. The alternative is discovering the difference between a floor and a ceiling after a watchdog has already done the sums for you.

At a glance

• The Big Shift: Europe’s AI rules price failures in bands, and each band is the higher of a euro amount or a share of global sales [1]. The €35 million that summaries quote belongs to the banned list alone, while a deployer’s own duties sit one tier down at €15 million or 3%.
• Why It Matters: For any firm above €500 million of sales the share wins, so the exposure is a number worked out from the balance sheet rather than a cap that can be absorbed. At €2 billion of sales the deployer band alone runs to €60 million [1].
• What I’d Watch: I am watching how the first cases price these tiers, and three details decide it.
• The crossing point: the sales level at which a share of global sales beats the euro figure. It is €500 million in both the 3% and 7% bands, and €750 million in the 1% band.
• The growing banned list: two more banned uses apply from 2 December 2026 [2], so the top band covers more conduct each year.
• The parallel privacy reading: the AI Act leaves the data-protection regime intact [4], so one incident can be priced at 3% and at 4% [1][5].
• The Catch: The bands are tops that a national watchdog then scales to the firm, and no case has yet shown how that discretion will be used. Below €500 million of sales the euro figure binds, and the headline number becomes the real one again.

Related reading

• AWS Cannot Restore Bahrain — more on Mental Models & Strategy
• Agent Identity: The Wrong Layer — more on Mental Models & Strategy
• Cloud Bill Break-Even — more on Mental Models & Strategy

Sources

[1] EU AI Act, Article 99 — Penalties (Regulation (EU) 2024/1689, consolidated): https://artificialintelligenceact.eu/article/99/ [2] EU AI Act, Article 113 — Entry into force and application: https://artificialintelligenceact.eu/article/113/ [3] EU AI Act, Article 101 — Fines for providers of general-purpose AI models: https://artificialintelligenceact.eu/article/101/ [4] EU AI Act, Article 2 — Scope: https://artificialintelligenceact.eu/article/2/ [5] General Data Protection Regulation, Article 83 — General conditions for imposing administrative fines: https://gdpr-info.eu/art-83-gdpr/ [6] EU AI Act, Article 26 — Obligations of deployers of high-risk AI systems: https://artificialintelligenceact.eu/article/26/