Timeline & penalties¶
Binding dates¶
| Date | What applies | Impact on you |
|---|---|---|
| 1 Aug 2024 | Regulation enters into force | Legal baseline |
| 2 Feb 2025 | Art. 5 prohibitions | If you do any banned practice, stop |
| 2 Feb 2025 | Art. 4 AI literacy | Every EU employer must train staff using AI |
| 2 Aug 2025 | GPAI provider obligations (Art. 53/55) | Affects Mistral/OpenAI/etc., not you |
| 2 Aug 2025 | Member-State governance framework live | MSA appointed, EU AI Office operational |
| 2 Aug 2026 | Most high-risk obligations (Arts. 6–49, 72, 73) | Main deadline for Annex III products |
| 2 Aug 2027 | High-risk systems under Annex I product-safety regimes | Medical devices, machinery, vehicles |
| 31 Dec 2030 | Public-sector legacy AI must comply | Grandfather deadline |
If your product is in Annex III today, plan against 2 August 2026. That's the day a Market Surveillance Authority can open an inquiry and demand your Annex IV dossier, Art. 12 logs, Art. 15 metrics, and Art. 73 incident filings.
Fines (Art. 99)¶
| Violation | Upper cap |
|---|---|
| Non-compliance with Art. 5 prohibitions | €35 M or 7 % of global annual turnover |
| Non-compliance with most Annex III high-risk obligations | €15 M or 3 % |
| Supplying incorrect / misleading information to authorities | €7.5 M or 1 % |
Higher of the fixed amount or the percentage applies. SMEs cap at the lower of the two (Art. 99(6)).
Fines are calculated considering nature/gravity, affected persons, financial benefit, previous infringements, cooperation, etc.
National penalties stack¶
In addition to AI-Act fines, you may face:
- GDPR fines (if personal data is involved) under Art. 83 GDPR.
- National sector-specific penalties (BaFin for finance, BfArM for medical devices, CNIL for privacy in France, etc.).
- Private-law damages under national non-discrimination or product-liability regimes (the Product Liability Directive applies to AI as a product from December 2026).
Treat the AI-Act fine as the minimum exposure, not the total.