Why the number matters to a board
A risk tier is abstract until it has a price. This session gives the Act's obligations their teeth: three fine tiers that mirror the risk tiers, a base of global turnover rather than EU-only revenue, and enforcement bodies with the power to investigate and penalise. For a board, this is the slide that turns "we should look at AI governance" into "we will fund AI governance this quarter" - because the downside is now a figure on the income statement, not a vague reputational worry.
The three fine tiers 9 min live
The Act does not have one fine. It has a ladder, and where you land depends on which kind of rule you broke. The worst breach - doing something the Act prohibits outright - carries the heaviest fine. Breaching an ordinary obligation is the middle tier. Giving an authority wrong or misleading information is the lightest. Every ceiling is a pair: a fixed euro cap or a percentage of your global turnover.
| What you did | Fixed cap | % of worldwide turnover |
|---|---|---|
| Broke a prohibition (Art 5 banned practice) | EUR 35 million | 7% |
| Breached other obligations (high-risk duties, Art 50 transparency) | EUR 15 million | 3% |
| Gave incorrect, incomplete or misleading information | EUR 7.5 million | 1% |
LiveHigher or lower - and always on global turnover3 min▶
Two details decide the real number, and both catch leaders off guard.
- Higher of the two, for most firms. The fine is up to the greater of the fixed cap or the percentage. For a large company the percentage usually wins - 7% of a big global turnover dwarfs EUR 35 million.
- Lower of the two, for SMEs and startups. The Act flips the rule for smaller firms: they face up to the lesser of the cap or the percentage, so the fine stays proportionate to their size.
- The base is worldwide turnover. Not EU revenue, not the revenue of the product at fault - your group's total worldwide annual turnover for the preceding financial year. This is why the number gets large fast.
LiveBigger than the GDPR3 min▶
- The GDPR's top tier. Data-protection leaders anchor on the GDPR's headline fine: up to EUR 20 million or 4% of global turnover, whichever is higher.
- The AI Act goes higher. Its top tier - EUR 35 million or 7% - is larger on both halves. For a firm already GDPR-conscious, the message is simple: the AI Act raises the ceiling.
- Why it lands. A board that respects the GDPR's number now has a bigger one to respect. The comparison is the fastest way to make AI governance a funded priority.
Who enforces the Act 8 min live
A fine needs a body to impose it. The Act splits enforcement in two. The big general-purpose AI models are overseen centrally by the European AI Office. Everything else is enforced nationally, by a market surveillance authority in each member state - and that national authority is your single point of contact.
LiveThe AI Office and national authorities3 min▶
Two layers, each with a clear remit:
- European AI Office (Art 64). A central body within the European Commission that supervises and enforces the rules for general-purpose AI models - the large foundation models. If you build or provide a GPAI model, the AI Office is your overseer.
- National market surveillance authorities (Art 74). Each member state designates one. They enforce the Act nationally and act as the single point of contact for companies and the public. For a high-risk system placed in a given country, its authority is who you deal with.
- GPAI-provider fines (Art 101). Providers of general-purpose AI models have their own dedicated penalty route - up to EUR 15 million or 3% of worldwide turnover - imposed by the Commission through the AI Office.
Vantage's exposure. Vantage's AI hiring tool is a high-risk system, not a general-purpose model - so its enforcer is a national market surveillance authority, not the AI Office. If the tool ships to its German customer without the conformity documentation and controls required of a high-risk system, Vantage sits in the middle tier: up to EUR 15 million or 3% of Vantage's worldwide turnover, whichever is higher. Ship a prohibited practice and it jumps to the 7% tier. That single German market entry is what put a real euro figure on the board's decision to fund governance now.
Self-studyFines are a ceiling, not a starting price2 min read▶
It is easy to read "up to 7%" as "7%", but the figures in Article 99 are maximums, not tariffs. Authorities are directed to set penalties that are effective, proportionate and dissuasive, and to weigh the circumstances of each case - the nature and gravity of the breach, whether it was intentional or negligent, whether you cooperated and self-reported, whether anyone was actually harmed, and the size and market position of the company. A first, minor, self-reported slip by a cooperative SME is a very different matter from a large firm that shipped a banned practice and hid it. This is not a reason to relax - the ceiling is real and the reputational damage of any enforcement action is its own cost - but it is a reason to build a governance program you can point to. Evidence that you took reasonable care, documented your decisions, and moved quickly to fix problems is exactly what pulls a penalty down from its ceiling. Governance is not only how you avoid a fine; it is how you argue the fine down if one ever comes.
Compute your ceilings ★ 12 min · pen and paper
Put your own numbers on the top two tiers. Abstract percentages become a board slide the moment they are your euros.
Write down your group's total worldwide annual turnover for the last financial year. Use the whole group, not just the EU or the product at fault.
Compute 7% of that figure - your prohibited-practice ceiling - and compare it to EUR 35 million. For most firms the percentage is higher; note which applies to you.
Compute 3% - your other-obligations ceiling, the one a non-compliant high-risk system sits in - and compare it to EUR 15 million.
If you are an SME or startup, remember the rule flips: your fine is capped at the lower of the two. Note both figures so the board sees the real exposure.
Rank what authorities weigh ★ 8 min · your next AI review
Four questions that reveal whether you would argue a penalty up or down.
"Could we show we took reasonable care - documented decisions, risk assessments, controls?" Evidence of care is the single biggest lever on a fine.
"If a problem surfaced, would we self-report and cooperate, or hope no one notices?" Cooperation and self-reporting pull the number down; concealment pushes it up.
"Do we know which national authority is our single point of contact in each EU market we enter?" If nobody can name it, you are not ready to ship.
"Are any of our uses anywhere near a prohibited practice?" That is the 7% tier - the one worth checking first and hardest.
Before session a5 ◐ 30 min total
- Keep your ceiling figures (7% and 3% of worldwide turnover) - a5 shows the frameworks that keep you off the ladder in the first place.
- Find out which national market surveillance authority governs each EU market you sell into, and whether anyone owns that relationship.
- Ask whether any of your AI uses could be near an Art 5 prohibited practice - the 7% tier is the one to rule out first.
- Optional: skim Article 99 - the penalty structure is short and the higher-vs-lower rule is worth reading in the original.
- What is our group's worldwide annual turnover, and therefore our 7% and 3% fine ceilings?
- Are we treated as a large firm (higher of the two) or an SME (lower of the two)?
- Which national market surveillance authority is our single point of contact in each EU market?
- Could we evidence reasonable care to an authority, or only assert it?
- Are any of our AI uses close to a prohibited practice - the 7% tier?
Official sources covered
Taught from the primary texts. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · A large company breaches an outright prohibition under the EU AI Act. The top fine tier is...
Prohibited-practice breaches carry the top tier under Article 99: up to EUR 35M or 7% of total worldwide turnover, and for a large firm the higher of the two applies.
2 · Vantage ships its high-risk AI hiring tool. Who is its enforcer, and which tier applies to a non-compliant high-risk system?
A high-risk system is enforced nationally (Art 74), not by the AI Office. Breaching high-risk obligations sits in the middle tier: up to EUR 15M or 3%.
3 · For an SME or startup, the fine under the EU AI Act is capped at...
The Act flips the rule for SMEs and startups: they face up to the lesser of the cap or the percentage, keeping the fine proportionate to their size.