Skip to content

Regulation Tracker / EU AI Act / Chapter XII

Article 99
Penalties

Chapter XII — Penalties. 12 distinct duties, powers or definitions are coded from this article, applying from 2025-08-02. 10 reach legal practice directly.

Amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27 — about 53 words changed. The text below is the consolidated version of 27 July 2026; the 2024 text and the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. In accordance with the terms and conditions laid down in this Regulation, Member States shall lay down the rules on penalties and other enforcement measures, which may also include administrative fines, warnings and non-monetary measures, applicable to any infringement of this Regulation by operators, and shall take all measures necessary to ensure that they are properly and effectively implemented, thereby taking into account the guidelines issued by the Commission pursuant to Article 96. The penalties provided for shall be effective, proportionate and dissuasive. The Member States shall take into account the interests of SMEs, including start-ups, and SMCs, and their economic viability when imposing penalties.

2. The Member States shall, without delay and at the latest by the date of entry into application, notify the Commission of the rules on penalties and of other enforcement measures referred to in paragraph 1, and shall notify it, without delay, of any subsequent amendment to them.

3. Non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

4. Non-compliance with any of the following provisions related to operators or notified bodies, other than those laid down in Articles 5, shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher:

  1. (a)obligations of providers pursuant to Article 16;
  2. (b)obligations of authorised representatives pursuant to Article 22;
  3. (c)obligations of importers pursuant to Article 23;
  4. (d)obligations of distributors pursuant to Article 24;
  5. (da)obligations of providers and operators pursuant to Article 25(2) and (4);
  6. (e)obligations of deployers pursuant to Article 26;
  7. (f)requirements and obligations of notified bodies pursuant to Article 31, Article 33(1), (3) and (4) or Article 34;
  8. (g)transparency obligations for providers and deployers pursuant to Article 50.

5. The supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request shall be subject to administrative fines of up to EUR 7 500 000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

6. In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.

6a. In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower.

7. When deciding whether to impose an administrative fine and when deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and, as appropriate, regard shall be given to the following:

  1. (a)the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system, as well as, where appropriate, the number of affected persons and the level of damage suffered by them;
  2. (b)whether administrative fines have already been applied by other market surveillance authorities to the same operator for the same infringement;
  3. (c)whether administrative fines have already been applied by other authorities to the same operator for infringements of other Union or national law, when such infringements result from the same activity or omission constituting a relevant infringement of this Regulation;
  4. (d)the size, the annual turnover and market share of the operator committing the infringement;
  5. (e)any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement;
  6. (f)the degree of cooperation with the national competent authorities, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
  7. (g)the degree of responsibility of the operator taking into account the technical and organisational measures implemented by it;
  8. (h)the manner in which the infringement became known to the national competent authorities, in particular whether, and if so to what extent, the operator notified the infringement;
  9. (i)the intentional or negligent character of the infringement;
  10. (j)any action taken by the operator to mitigate the harm suffered by the affected persons.

8. Each Member State shall lay down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State.

9. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or by other bodies, as applicable in those Member States. The application of such rules in those Member States shall have an equivalent effect.

10. The exercise of powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including effective judicial remedies and due process.

11. Member States shall, on an annual basis, report to the Commission about the administrative fines they have issued during that year, in accordance with this Article, and about any related litigation or judicial proceedings.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

  1. Art. 99(1)PenaltyNot tier-specificlegal practice

    Member States must lay down rules on penalties and other enforcement measures for any AI Act infringement by operators and ensure effective implementation, with effective, proportionate and dissuasive penalties and attention to SMEs and SMCs.

    "Member States shall lay down the rules on penalties and other enforcement measures, which may also include administrative fines, warnings and non-monetary measures, applicable to any infringement of this Regulation by operators"
    Who
    Member State
    From
    (Art. 113(b))
    Fine tier
    Art. 99
    Legal practice
    Reaches legal practice directly — National penalty rules determine exposure for legal-AI providers, deployers and other operators.
    See
    Art. 96

  2. Art. 99(2)Cooperation with authoritiesNot tier-specific

    Member States must notify the Commission of penalty and enforcement-measure rules by the date of entry into application and notify subsequent amendments without delay.

    "The Member States shall, without delay and at the latest by the date of entry into application, notify the Commission of the rules on penalties and of other enforcement measures"
    Who
    Member State
    From
    (Art. 113(b))
    Legal practice
    Reaches legal-AI vendors or public bodies — This supports transparency around national penalty regimes affecting legal-sector AI operators.
    See
    Art. 99(1)

  3. Art. 99(3)PenaltyProhibited practicelegal practice

    Non-compliance with Article 5 prohibited AI practices is subject to administrative fines up to EUR 35,000,000 or, for undertakings, 7% of total worldwide annual turnover, whichever is higher.

    "administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher."
    Who
    Any operator
    From
    (Art. 113(b))
    Fine tier
    Art. 99(3)
    Legal practice
    Reaches legal practice directly — Article 5 prohibited-practice penalties can apply to legal-AI providers or deployers engaging in prohibited practices.
    See
    Art. 5

  4. Art. 99(4)PenaltyNot tier-specificlegal practice

    Non-compliance with specified operator, notified-body and transparency provisions is subject to fines up to EUR 15,000,000 or, for undertakings, 3% of total worldwide annual turnover, whichever is higher.

    "administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher:"
    Who
    Provider, Authorised representative, Importer, Distributor, Deployer, Notified body, Any operator
    From
    (Art. 113(b))
    Fine tier
    Art. 99(4)
    Legal practice
    Reaches legal practice directly — This is the main fine tier for high-risk provider/deployer duties and transparency duties relevant to legal-AI vendors and users.
    See
    Art. 16 · Art. 22 · Art. 23 · Art. 24 · Art. 25(2) · Art. 25(4) · Art. 26 · Art. 31 · Art. 33 · Art. 34 · Art. 50

  5. Art. 99(5)PenaltyNot tier-specificlegal practice

    Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in response to a request is subject to fines up to EUR 7,500,000 or 1% of worldwide turnover, whichever is higher.

    "administrative fines of up to EUR 7 500 000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher."
    Who
    Any operator
    From
    (Art. 113(b))
    Fine tier
    Art. 99(5)
    Legal practice
    Reaches legal practice directly — Legal-AI operators responding to regulators or notified bodies must avoid incorrect, incomplete or misleading information.
    See
    notified bodies · national competent authorities

  6. Art. 99(6)PenaltyNot tier-specificlegal practice

    For SMEs, including start-ups, each Article 99 fine is capped at the lower of the percentage or amount referred to in paragraphs 3, 4 and 5.

    "In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower."
    Who
    Any operator
    From
    (Art. 113(b))
    Fine tier
    Art. 99(6)
    Legal practice
    Reaches legal practice directly — Small legal-tech vendors may benefit from the SME lower-of cap across Article 99 fine tiers.
    See
    Art. 99(3) · Art. 99(4) · Art. 99(5)

  7. Art. 99(6a)PenaltyNot tier-specificlegal practice

    For SMCs, each fine under Article 99(4) and (5) is capped at the lower of the percentage or amount stated in those paragraphs.

    "In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower."
    Who
    Any operator
    From
    (Art. 113(b))
    Fine tier
    Art. 99(6a)
    Legal practice
    Reaches legal practice directly — Small mid-cap legal-tech or legal-service operators receive lower-of treatment for the 3%/EUR 15 million and 1%/EUR 7.5 million tiers.
    See
    Art. 99(4) · Art. 99(5)

  8. Art. 99(7)PenaltyNot tier-specificlegal practice

    Authorities deciding whether to impose an administrative fine and its amount must consider all relevant circumstances, including gravity, duplicate penalties, size, aggravating or mitigating factors, cooperation, responsibility, notification, intent and mitigation.

    "all relevant circumstances of the specific situation shall be taken into account"
    Who
    Market surveillance authority, National competent authority
    From
    (Art. 113(b))
    Fine tier
    Art. 99(7)
    Legal practice
    Reaches legal practice directly — These factors shape penalty exposure for legal-AI providers, deployers and other operators.
    See
    Art. 99(7)(a)-(j)

  9. Art. 99(8)PenaltyNot tier-specificlegal practice

    Each Member State must set rules on the extent to which administrative fines may be imposed on public authorities and bodies established in that Member State.

    "Each Member State shall lay down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State."
    Who
    Member State, Public-authority deployer
    From
    (Art. 113(b))
    Fine tier
    Art. 99(8)
    Legal practice
    Reaches legal practice directly — Courts and public legal bodies deploying AI may face national rules on public-authority fines.
    See
    public authorities and bodies

  10. Art. 99(9)PenaltyNot tier-specificlegal practice

    Depending on national legal systems, administrative-fine rules may be applied by competent national courts or other bodies, with equivalent effect.

    "the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or by other bodies"
    Who
    Member State, Other
    From
    (Art. 113(b))
    Fine tier
    Art. 99(9)
    Legal practice
    Reaches legal practice directly — National courts may be involved in imposing AI Act administrative fines, depending on Member State systems.
    See
    national courts

  11. Art. 99(10)Right of personNot tier-specificlegal practice

    Exercise of Article 99 powers must be subject to appropriate procedural safeguards under Union and national law, including effective judicial remedies and due process.

    "The exercise of powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including effective judicial remedies and due process."
    Who
    Member State, National competent authority
    From
    (Art. 113(b))
    Fine tier
    Art. 99(10)
    Legal practice
    Reaches legal practice directly — Legal-AI operators subject to penalties have procedural-safeguard and remedy protections.
    See
    Union law · national law

  12. Art. 99(11)Cooperation with authoritiesNot tier-specific

    Member States must annually report to the Commission on Article 99 administrative fines issued during the year and related litigation or judicial proceedings.

    "Member States shall, on an annual basis, report to the Commission about the administrative fines they have issued during that year"
    Who
    Member State
    From
    (Art. 113(b))
    Fine tier
    Art. 99(11)
    Legal practice
    Reaches legal-AI vendors or public bodies — This can reveal enforcement involving legal-AI operators and related proceedings.
    See
    Art. 99

Cite

Regulation (EU) 2024/1689, Article 99 (Penalties), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_99 — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-99, accessed 2026-09-08, CC BY 4.0.