Definition: Administrative Fines (EU AI Act)
Administrative fines under the EU AI Act are monetary penalties that national authorities impose on organizations breaching obligations in the EU AI Act, ranging from a few million euros to tens of millions depending on severity.
Core characteristics of administrative fines
The more a violation threatens fundamental rights or safety, the higher the ceiling.
- Three statutory tiers, each combining a fixed euro ceiling with a turnover percentage
- The higher figure applies to large companies, the lower to SMEs
- Fines apply to providers, deployers, importers, distributors and representatives
- National authorities set the actual amount within the ceiling
Administrative Fines (EU AI Act) vs. civil AI liability
Administrative fines are public-law penalties paid to the state; civil AI liability is a private-law damages claim brought by a harmed person, decided by a court. A biased hiring algorithm can trigger both a fine for the underlying high-risk AI system violation and a civil claim from the candidate.
Importance of administrative fines in enterprise AI
The ceiling for prohibited practices exceeds GDPR, which caps fines at 4% of turnover or €20 million under Article 83 of Regulation (EU) 2016/679. A 2024 Bitkom survey found fewer than one in three German companies felt well prepared for the AI Act’s obligations.
Methods and procedures for administrative fines
Knowing how a fine is calculated helps companies prioritize compliance effort.
The three-tier penalty structure
Article 99 sets three ceilings, each with a fixed amount and a percentage of worldwide turnover.
- Up to €35 million or 7% of turnover for prohibited AI practices under Article 5
- Up to €15 million or 3% of turnover for high-risk or general-purpose AI model obligations
- Up to €7.5 million or 1% of turnover for misleading authorities or notified bodies
SME and startup caps
For SMEs, including startups, each fine is capped at whichever of the fixed amount or the percentage is lower, not higher. This keeps a multinational-scale formula from applying unmodified to a smaller company.
National enforcement and market surveillance
Each member state appoints market surveillance authorities to investigate, audit and fine. In Germany this sits mainly with the Bundesnetzagentur, alongside sector regulators such as BaFin.
Important KPIs for administrative fines
Companies track readiness and exposure metrics to keep fine risk visible to management.
Compliance readiness metrics
- AI use case inventory: 100% of systems classified by risk tier
- Documentation completeness: technical files ready per high-risk system
- Incident response time: under 72 hours from detection to notification
- Staff training coverage: 100% of AI-facing roles trained
Exposure and financial metrics
Finance and legal teams model worst-case fine exposure as a share of turnover, the basis regulators use. Risk advisors recommend boards track this alongside cyber risk.
Quality of oversight metrics
Internal audit checks how many high-risk deployments have a named reviewer, an escalation path and a tested override, the first things an inspector checks.
Risk factors and controls for administrative fines
Most fines trace back to a small set of recurring failure modes, not deliberate wrongdoing.
Misclassification of AI systems
Companies often underestimate which tools count as high-risk, particularly in HR, credit and safety-adjacent use cases.
- Treating a vendor tool as “just software” without checking its category
- Missing a reclassification when a use case changes after deployment
- No single owner for the risk classification register
Weak AI compliance programs
A fragmented AI compliance program, shifting between IT and legal, is a common cause of missed deadlines. Regulators look for an ongoing process, not a checklist before an audit.
Underinsured liability exposure
Even well-governed companies face residual risk. AI liability insurance rarely covers fines themselves, but it cushions legal costs and claims that follow an investigation.
Practical example
A 160-employee precision parts manufacturer in Baden-Wurttemberg used a third-party AI tool to pre-screen job applicants. A review found it qualified as high-risk under Annex III but lacked required documentation. The company classified the tool, built a technical file, named a compliance owner and ran a mock inspection before informing its works council.
- Risk classification workshop for every AI tool before rollout
- Technical documentation template reused across departments
- Named compliance owner with authority to pause non-compliant tools
- Quarterly review cycle aligned with HR and procurement
Current developments and effects
Enforcement is ramping up as authorities build capacity and issue first guidance.
Early enforcement signals
Most member states only finalized penalty regimes in 2025, so case law is thin, but authorities prioritize prohibited practices and high-risk HR and credit use cases first.
- First investigations opening in consumer-facing scoring tools
- Authorities publishing sector guidance ahead of fines
- Coordination rising between data protection and AI surveillance bodies
Convergence with other regulations
Authorities cross-reference GDPR and sector rules, so one investigation can trigger parallel proceedings under several laws.
Rising insurance and advisory demand
Legal and insurance markets now offer dedicated AI Act advisory services, reflecting how seriously enterprises treat this exposure.
Conclusion
Administrative fines under the EU AI Act turn AI governance into a board-level financial risk, with ceilings that can exceed GDPR penalties. Mittelstand companies that classify systems correctly, document decisions and assign ownership face far less enforcement risk than those treating compliance as an afterthought. The SME cap softens the blow but does not remove the obligation to comply. Early, structured compliance work remains the most reliable protection as enforcement matures.
Frequently Asked Questions
What is the maximum fine under the EU AI Act?
The highest tier covers prohibited AI practices and reaches up to €35 million or 7% of worldwide turnover, whichever is higher. High-risk system violations are capped lower, at up to €15 million or 3% of turnover.
How are fines different for SMEs?
Article 99 caps each SME or startup fine at the lower of the fixed amount or the turnover percentage, reversing the rule for larger companies, so a multinational-scale formula does not apply unmodified to a Mittelstand business.
Does the EU AI Act apply to a 50-employee company?
Yes. Obligations depend on the company’s role and the AI system’s risk category, not headcount. A 50-employee company using a high-risk HR tool carries the same duties as a larger one, with a lower fine ceiling.
What does it cost to prepare for AI Act fines?
Cost depends on how many systems qualify as high-risk, but a focused classification and documentation project for a mid-sized company typically runs into the low tens of thousands of euros, not a dedicated department.
How long does it take to become compliant and avoid fines?
Most companies can complete an initial risk classification and close urgent documentation gaps within two to three months, though full compliance across several high-risk systems takes longer. Starting early matters more than starting big.
How does Superkind help avoid the compliance gaps that lead to fines?
Superkind builds AI employees on top of a company’s knowledge and systems, with human approval built into the workflow, making it easier to document who reviewed what and when. It does not replace legal advice on classification, but it reduces the operational gaps that often turn into violations.
