As of October 2026, no fine under the EU AI Act itself has been publicly confirmed. The prohibitions have been enforceable since August 2025, and the Commission's powers to fine general-purpose AI providers since 2 August 2026. But many member states were slow to designate their authorities. The significant AI-related penalties so far have come under the GDPR, for example the Dutch DPA's €30.5 million fine on Clearview AI and the Italian Garante's €5 million fine on the maker of Replika.
"Is anyone actually enforcing the AI Act?" is a reasonable question for anyone budgeting for compliance. Here's who can fine, how much, what has happened so far, and why the absence of AI Act fines doesn't mean an absence of risk.
EU AI Act penalty tiers (Article 99)
| Infringement | Maximum fine |
|---|---|
| Prohibited AI practices (Art. 5) | €35 million or 7% of worldwide annual turnover, whichever is higher |
| Most other obligations (providers, deployers, importers, distributors, notified bodies, transparency) | €15 million or 3% |
| Supplying incorrect, incomplete or misleading information to authorities | €7.5 million or 1% |
| GPAI model providers (Art. 101, imposed by the Commission) | €15 million or 3% |
For SMEs and start-ups, each cap is the lower of the two amounts.
Who enforces the AI Act
- National market surveillance authorities enforce most obligations, including the prohibitions. Member states had to designate them by 2 August 2025. Many missed that deadline. Germany, for example, brought its implementing act into force in July 2026, naming the Bundesnetzagentur as its central authority.
- The European Commission's AI Office supervises GPAI model providers and, under the 2026 Digital Omnibus, gained exclusive competence over certain AI systems built on GPAI models and integrated into very large online platforms.
- Data protection authorities often have roles for biometric and law-enforcement uses, and keep their full GDPR powers.
What has happened so far
| Date | Event |
|---|---|
| 2 Feb 2025 | Prohibitions apply; Commission guidelines on prohibited practices follow |
| 2 Aug 2025 | Penalty provisions and GPAI obligations apply; GPAI Code of Practice published in July 2025 |
| May 2026 | Italy's Garante warns an employer platform about workplace emotion inference, citing AI Act Article 5(1)(f), but acting under its GDPR powers |
| 27 Jul 2026 | Digital Omnibus on AI enters into force, delaying high-risk obligations |
| 2 Aug 2026 | Commission's GPAI fining powers apply; Article 50 transparency applies; Commission whistleblower and complaint tools available |
Independent enforcement trackers reviewing public sources up to October 2026 haven't recorded a confirmed AI Act fine.
AI-related fines under the GDPR
| Company | Authority | Fine | Issue |
|---|---|---|---|
| Clearview AI | Dutch DPA (2024) | €30.5m | Illegal facial recognition database |
| Clearview AI | Italy (2022), France (2022) | €20m each (France added €5.2m in penalty payments) | Same |
| Luka Inc. (Replika) | Italy (2025) | €5m | Lawful basis, transparency, age verification for an AI companion chatbot |
| OpenAI | Italy (2024) | €15m, annulled by a Rome court in March 2026 | ChatGPT training data and transparency |
What this means for compliance planning
- Prioritise the prohibitions and Article 50 now. They're live and the most visible.
- Expect GPAI enforcement to start with information requests and commitments rather than immediate fines.
- Treat GDPR as the current enforcement route for AI that processes personal data.
- Use the high-risk delay to build documentation and governance. See what applies after 2 August 2026.
Penalties and enforcement are AIGP staples
The AIGP Complete Pack covers AI Act penalty tiers, enforcement bodies and the GDPR overlap in its Cram Guide and 300 practice questions.
Get the Complete PackWhat enforcement is likely to look like first
- Prohibited practices: the prohibitions have applied since 2 February 2025, so the first AI Act cases are most likely to involve banned uses such as untargeted facial image scraping, workplace emotion recognition or manipulative systems.
- General-purpose AI models: the AI Office's powers to fine GPAI providers started on 2 August 2026, though early action is likely to focus on information requests and dialogue.
- Transparency duties: Article 50 applies from 2 August 2026, so chatbot disclosure and deepfake labelling are likely early priorities for national authorities.
- High-risk systems: obligations don't apply until 2 December 2027 (Annex III) and 2 August 2028 (Annex I), so high-risk fines are unlikely before then.
How fines are calculated
Article 99 requires penalties to be effective, proportionate and dissuasive. Authorities must consider factors such as the nature, gravity and duration of the infringement, the number of people affected, any action taken to mitigate harm, previous infringements, cooperation with authorities, the size and market share of the operator, and whether the infringement was intentional or negligent. For SMEs and start-ups, the lower of the fixed amount and the percentage applies.
Lessons from GDPR enforcement on AI
Data protection authorities have already fined AI-related processing under the GDPR, including cases involving facial recognition databases and generative AI chatbots. Common themes are a missing or weak lawful basis for training data, lack of transparency to individuals, inadequate age verification for services used by children, and failure to respond to regulators. These are good indicators of what AI Act regulators will also look for.
Frequently asked questions
Has anyone been fined under the EU AI Act?
As of October 2026, no AI Act fine has been publicly confirmed. AI-related fines to date have been issued under the GDPR.
What is the maximum fine under the EU AI Act?
Up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices.
Who can fine companies under the EU AI Act?
National market surveillance authorities for most obligations, and the European Commission for GPAI model providers.
When can the Commission fine GPAI providers?
From 2 August 2026, under Article 101.
What factors affect the size of an EU AI Act fine?
Article 99 lists factors including the nature, gravity and duration of the infringement, the number of people affected, mitigation, previous infringements, cooperation, the operator's size and market share, and whether it was intentional or negligent.
Sources
- Regulation (EU) 2024/1689 (EU AI Act), EUR-Lex (Articles 99 and 101)
- Vorp Labs: EU AI enforcement tracker 2026
- Gibson Dunn: EU AI Act Omnibus agreement
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
Last reviewed: October 2026. We'll update this page when the first AI Act fine is confirmed.