Article 99 Penalties: requirements and evidence

Article 99 penalties: what the three fine tiers can cost an operator

A compliance lead briefing the board should start with the ceiling for each breach tier. Article 99 sets three maximum administrative fines. The first reaches EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year, for breaches of the Article 5 prohibited practices. The second reaches EUR 15 million or 3% for most operator obligations, including duties for providers, deployers and importers, the Article 50 transparency duties, and requirements placed on notified bodies. The third reaches EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities. For a large undertaking, the higher figure in each pair applies. Illustrative only: a group with EUR 2 billion in worldwide turnover would face a second-tier ceiling of EUR 60 million, because 3% of that turnover exceeds EUR 15 million.

The penalty chapter has applied since 2 August 2025, so the fine framework is live now, well before most of the Act's operational duties take effect. Member States must have set their own penalty rules, notified them to the Commission and reported fines each year, so the board should confirm which national rules apply in each country where the organization places or uses AI systems. Smaller businesses get a lower cap. For SMEs, including start-ups, each fine is limited to whichever figure is lower, and the 2026 amendment extended the same lower cap to small mid-cap enterprises for the second and third tiers. Confirm the group's size status with counsel before quoting any figure to the board, because the cap that applies depends on it.

Article 99 sets ceilings, not fixed fines. An authority chooses the amount within the cap by weighing the factors in Article 99(7), including gravity, duration, the number of people affected, the organization's size and market share, cooperation, measures taken, whether the operator notified the breach itself, and whether the conduct was intentional or negligent. The real exposure comes from combining a tier with the authority's view of conduct. A late incident report that is well documented and an unlabeled deepfake published with no record of review carry very different risk. Before the board discussion, map each AI system to the tier its breaches would fall under, and list the evidence that would show cooperation and mitigation. The text of Article 99 on EUR-Lex sets out the factors in full.

How the SME and small mid-cap caps change the Article 99 maximum

The SME cap changes the ceiling on a fine, not the conduct that triggers it. Under Article 99(6), an SME, including a start-up, faces a maximum for each fine set at whichever of the two figures is lower: the euro amount or the percentage of worldwide annual turnover. Regulation (EU) 2026/1744 extended the same lower-of rule to small mid-cap enterprises through Article 99(6a), but only for the paragraph 4 and 5 fines, which cover operator obligations such as those in Article 26 and Article 50, and misleading information supplied to authorities. The Article 5 prohibition tier in Article 99(3) is not covered by that extension as stated in the facts, so an organization in the small mid-cap band should not assume the lower cap applies to a prohibited practice. Confirm the tier with counsel before relying on any reduced figure.

Whether a company is an SME or a small mid-cap is a legal test, and the reader owns the answer. The size thresholds depend on headcount and on turnover or balance sheet totals, and the test for a group of linked or partner enterprises can change the result. Ask counsel to confirm the category against the current definitions in EU recommendations and the Act, and to state the reference period used. Keep the file that proves the answer: payroll or FTE records for the period, annual accounts for the last financial year, and a group structure chart showing linked and partner enterprises. An authority will expect audited or filed accounts where they exist, and will test whether the headcount reflects the whole group rather than one legal entity.

Treat the size determination as a decision with an owner and a date. Record who made it, the figures used, and when it was last reviewed, because headcount and turnover move, and a company that crosses a threshold during a dispute may find the cap changes under it. Where the company holds subsidiaries or sits inside a larger group, the penalty exposure for the group may still be set by the parent's turnover, so the cap analysis should be run at both levels. Ask counsel to model the maximum fine under each tier for the specific AI systems in scope, since the answer differs for a prohibited practice and for a transparency breach. The worked calculation is the evidence a board will want to see.

How authorities test penalty exposure during an investigation

This table maps each factor an authority weighs under Article 99(7) to the question it asks, what it examines, the evidence it requests and the findings that tend to raise a fine. Read it as a checklist of what your file must show before an investigation starts, since the same records drive the fine level and any reduction.

Assessment factor	What the authority examines	Evidence requested	Findings that push a fine upward
Breach classification	Which tier applies: prohibited practice, operator obligation, or incorrect information to authorities	System inventory, use-case description, and the Article 5 or operator obligation at issue	Use case that falls within a prohibition, or a tier misidentified in internal records
Duration	How long the non-compliant conduct ran before it stopped or was corrected	Dated logs, version history of the system, and change records showing when the gap started	Months or years of operation without a corrective step after a gap was known
Affected persons	How many people were exposed to the system or its decisions, and who they are	Deployment scope, user counts, decision volumes, and records of affected groups	Broad rollout to vulnerable groups, or no ability to show the scale of exposure
Intent or negligence	Whether the organization knew the obligation applied and chose not to act, or failed to take reasonable care	Board or governance minutes, risk assessments, training records and the AI literacy file	Documented warnings or internal objections that were ignored
Cooperation	How quickly and fully the organization answers requests and makes systems available	Response timelines, named contacts, access arrangements and document production logs	Delayed or partial answers, or resistance to on-site or technical review
Self-notification	Whether the organization reported the breach to the authority on its own initiative	Copy of the notification, date of discovery and the internal decision record	No report made despite internal awareness, or a report made only after a third party raised the issue
Measures taken	What the organization did to stop, correct or limit the harm, and when	Remediation plan, change tickets, rollback records, and post-fix test results	Corrective action limited to paperwork, or no measures before the investigation
Prior fines for the same conduct	Whether the same conduct was already sanctioned, under this Act or other rules applied to the same facts	Record of earlier decisions, regulator correspondence and any multi-jurisdiction penalties	Repeat conduct after an earlier fine, or unresolved findings from a prior review

Who can fine whom: national authorities, the AI Office and EU institutions

For most private operators, this is the tab that applies. National market surveillance authorities enforce the AI Act for AI systems, and each Member State sets its own penalty rules within the Article 99 framework. Those rules must be notified to the Commission, and Member States report the fines they impose each year. The fine ceilings in Article 99 are maximums that the national authority applies case by case, so the authority in the country where you are established or where your AI output is used will decide what happens to you.

Who enforces: national market surveillance authorities designated under the Act enforce it for AI systems, including high-risk systems deployed by private companies.
Penalty rules: each Member State adopts its own penalty provisions and notifies them to the Commission, so the procedure and local detail vary by country.
Annual reporting: Member States report the fines they impose each year, which makes enforcement visible at EU level.
Applicable fine tiers: the three Article 99 tiers and the SME lower caps are applied by these authorities when they set a fine.
Scope reach: Article 2 applies the Act to non-EU providers and deployers whose AI output is used in the EU, so authorities in several countries may have jurisdiction over one system.

Before assuming which authority applies, check the national designation list for each Member State where your systems are placed on the market or used, and confirm the local penalty rules with counsel.

The Article 99(7) factors that set the size of a fine

Article 99(7) does not fix a fine. It lists the factors an authority weighs once a breach is established, so the amount reflects both the seriousness of the conduct and how the operator behaved. The cards below group those factors and show the kind of record that helps an operator on each one.

Gravity and duration

Authorities ask how serious the breach was and how long it ran. A single misconfigured control caught and fixed within days reads very differently from a prohibited or high-risk practice left running for months. Check that you can show when the conduct started, when you first detected it, and when it stopped. A dated change log and a timestamped incident ticket answer both questions without reconstruction.

Affected persons

Authorities look at how many people were affected, who they were, and what harm they faced. An AI system used on job applicants, patients or customers carries more weight than an internal tool with no effect on individuals. Keep an inventory that records which people each AI system touches and the populations exposed, so you can answer quickly when an authority asks for the scale of impact.

Size and market share

The size of the operator and its position in the market shape the fine. Authorities consider annual turnover, the share of the market served, and whether the operator is an SME or small mid-cap, which carries lower caps under Article 99(6) and (6a). Keep current, audited turnover and documented headcount ready, since these inputs determine which cap applies and how the authority scales the penalty.

Cooperation and measures taken

Authorities credit operators that respond constructively once a breach surfaces. This includes preserving records, giving timely answers to information requests, and fixing the cause rather than only the symptom. Prepare a response playbook that names who speaks to the authority, who owns remediation, and how corrective actions are tracked to closure, so cooperation is demonstrated rather than asserted.

Self-notification

Article 99(7) names self-notification as a factor. An operator that reports its own breach to the competent authority before the authority learns of it can expect that to weigh in its favour. Build an internal escalation path that checks AI incidents against the reporting duties that apply to your role, and record the date you identified the breach, the date you decided to notify, and the content of the notice.

Intent, negligence and mitigation

Authorities distinguish deliberate breaches from those caused by lapses, and they weigh any mitigation the operator applied. A documented AI governance policy, routine staff training on AI literacy, and pre-release testing records show that a breach was an exception rather than a designed outcome. Keep those records current, because an authority will ask what controls existed before the breach, not what was written afterward.

Steps to build a penalty-ready compliance file

This sequence gives an organization a record that shows which Article 99 tier each AI activity could reach, how its size is tested for the lower SME caps, and what it did and told authorities when something went wrong. It produces a file an assessor or authority can check against the facts.

Inventory AI systems and assign roles
Start with a register of every AI system in use, in development or being bought, and record for each whether your organization acts as provider, deployer, importer, distributor or another operator. Legal or compliance staff, working with the system owners, should complete the register and confirm the role for each entry with the business owner. The step is done when every system has a named owner, a role and a short note on its intended purpose, so the next step has a fixed set of items to test.
Map each system to a penalty tier
For each inventoried system, identify which Article 99 tier a breach could engage: the EUR 35 million or 7% tier for Article 5 prohibited practices, the EUR 15 million or 3% tier for most operator duties, or the EUR 7.5 million or 1% tier for incorrect or misleading information supplied to notified bodies or national competent authorities. Record the articles that apply to each system and the reason. The output is a tier map that a reviewer can trace from system to article, and it should be reviewed whenever a system's use or classification changes.
Record turnover and headcount evidence
Collect the figures needed to test whether the lower SME or small mid-cap caps could apply: total worldwide annual turnover for the preceding financial year, headcount, and the group relationships that determine whether the organization counts as a stand-alone enterprise. Finance and HR should source these from audited accounts and payroll records, and legal should confirm group structure with the enterprise classification rules. Ask counsel to confirm which definitions and thresholds apply, since the file should state the basis on which the cap was or was not applied.
Set up self-notification and incident paths
Define who decides whether an AI incident or non-compliance must be reported to a national competent authority or market surveillance authority, who drafts the notice, and who signs it. Article 99(7) treats self-notification as a factor in setting a fine, so the path should also record the date a problem was first identified and the date it was reported. Test the path with a tabletop exercise, and record the result. The output is a written escalation procedure with named roles and a log template.
Document measures taken and their dates
For each finding, keep a dated record of the corrective and preventive measures taken, who approved them, and the evidence that they worked, such as test results, configuration changes, retraining records or withdrawal notices. Authorities weigh cooperation, measures taken and mitigation when they set a fine, so the file should show the sequence clearly. Compliance and engineering leads should review the log each quarter and at each material change. The output is a remediation ledger that links each finding to its evidence.
Keep a register of information supplied to authorities
Record every submission, answer, document and correction sent to a notified body, national competent authority or other regulator, including the version, the date, the sender and the source data behind each statement. Before anything is sent, a second reviewer should check it for accuracy, completeness and whether it could be read as misleading, since Article 99(5) addresses exactly these failures. The step is complete when each submission can be traced back to its evidence and any later correction is logged alongside the original.
Review the file with counsel and an assessor
Once the earlier steps are in place, ask legal counsel to review the tier map, the size analysis and the penalty factors in Article 99(7), and ask an independent assessor or auditor to test whether the evidence supports each statement. Only the organization owns its compliance position, and external reviewers give an opinion but do not issue a legal conclusion or certificate. The output is a signed review record, a list of open actions, and a date for the next review.

Evidence that shows mitigation under Article 99

Article 99(7) lists the factors an authority weighs when setting a fine, including cooperation, measures taken, self-notification and mitigation. The cards below are the records that let an organization show those factors with dated proof rather than assertion. Each one should be reviewed on a fixed cadence and updated when the underlying facts change.

Dated AI system inventory with roles

The inventory lists every AI system the organization builds, places on the market, deploys or uses, with the role held for each (provider, deployer, importer, distributor or other operator), the Article 5 and Annex III screening result, and the date of the last review. Authorities look for it first because it shows the organization knew what it was running. Keep it current by adding a line before any new system goes live and by re-checking roles whenever a system is modified, fine-tuned or moved to a new use case.

Breach log with discovery and reporting dates

Record each suspected breach of an AI Act obligation with the date it was found, who found it, the provisions likely engaged, and the date it was reported to a national authority or notified body, if it was. Self-notification is one of the factors named in Article 99(7), so the gap between discovery and report matters. Review open entries weekly, and close an entry only with a linked remediation record and a stated reason.

Remediation register with timestamps

Track every corrective action from the breach log with an owner, a planned date, the actual completion date and a verification step, such as a retest or a control check. Timestamps show that measures were taken promptly, which feeds the mitigation factor. Confirm that each closure is verified by someone other than the person who made the change, and that overdue items are escalated to the accountable executive.

Records of cooperation with authorities

Keep a dated file of every request from a national market surveillance authority, notifying authority or the AI Office, with the response, the documents provided and any agreed follow-up. Cooperation is an explicit factor under Article 99(7). Log each contact on the day it happens, name the staff involved, and store the transmitted files with hashes or version identifiers so the organization can show exactly what was disclosed.

Accuracy review for every authority submission

Before any submission to a national authority or notified body, a second reviewer checks it against source records and signs the review with a date. Article 99(5) sets fines for supplying incorrect, incomplete or misleading information, so this review is the control that prevents that exposure. Keep the reviewer's checklist, the source references used and the version sent, and re-run the review if the submission is corrected later.

Board minutes recording governance decisions

Minutes that record AI Act decisions show who approved risk classifications, accepted residual risks, funded remediation and set the compliance policy. They support the governance and intent or negligence factors in Article 99(7). Ask the company secretary to minute each decision with the date, the options considered and the accountable owner, and to attach the relevant register extract. Confirm that the board receives the breach log and remediation register at each scheduled meeting.

What preparing for Article 99 exposure costs in money and effort

This table lists the cost components of preparing for Article 99 exposure, who is paid for each, whether it is one-time or recurring, and what drives it up or down. No price is given, so use the drivers and quote questions as the basis for comparing written proposals.

Cost component	One-time or recurring	What drives it	How to keep it down
Legal review of the fine tiers and turnover base	One-time, revisited when the group structure or turnover changes	Group structure, number of entities placing AI on the EU market, whether SME or small mid-cap caps may apply, and how worldwide annual turnover is measured for the preceding financial year	Map each AI system to its operator role and the Article 99 tier it could breach before engaging counsel, so the review answers specific questions
Penalty-ready evidence file	Initial build, then recurring upkeep	Number of AI systems in scope, how many Article 5, 16, 22 to 26 or 50 obligations apply to each, and whether logs and records already exist	Reuse evidence produced for other obligations, keep one owner per record, and automate log retention where the platform allows it
Incident and self-notification process design	One-time design, recurring testing	Number of authorities and Member States involved, the reporting paths to notified bodies and national competent authorities, and the mitigation and cooperation record the Article 99(7) factors reward	Write one decision tree for when to notify, and run tabletop exercises on it rather than building separate playbooks per system
Training of staff who sign submissions	Initial, then recurring refreshers	Number of signatories, the volume of information sent to authorities, and changes in staff or accountable roles	Limit signing authority to a small named group and train on the misleading-information duty in Article 99(5) once per cycle
External counsel or consultant review	Recurring for specific reviews, usually fixed-scope	Complexity of the legal position, number of Member States, and whether counsel or a consultant reviews the evidence file or only legal questions	Agree the scope in writing, separate legal opinion from technical evidence work, and ask for a fixed price per review
Internal time answering authority requests	Recurring, spikes during inquiries	Number of information requests, the time needed to locate evidence, and how many teams hold the data	Keep the evidence file indexed, assign one response coordinator, and pre-approve standard answer templates
Mitigation and corrective measures	Varies with findings, mostly one-time per issue	Severity of any finding, whether affected persons are many, and the duration of the conduct	Track known gaps in a register with owners and dates so remediation starts before any authority asks

Who owns the penalty risk: your team, a partner and the authority

Your organization carries the penalty exposure. Only you can decide which AI systems are in scope, which role you hold for each system (provider, deployer, importer or distributor), and whether a breach must be self-notified or corrected. Your legal team also holds the worldwide annual turnover figure for the preceding financial year, because the percentage caps in Article 99 are calculated from it, and it decides how to answer any information request from an authority.

Scope and role decisions: Record which Article 5 or Article 50 duties apply to each system and why, and review that record when a system changes.
Turnover data: Confirm with finance how worldwide annual turnover for the preceding financial year would be determined and kept current, since the higher-of test depends on it.
Submissions and correspondence: Own every reply to a national competent authority or the AI Office, including the accuracy of anything supplied under Article 99(5).
Mitigation record: Document cooperation, measures taken and any self-notification, which Article 99(7) lists as factors in setting a fine.
Legal opinion: Obtain advice on fine exposure, appeal options and national penalty rules from counsel, not from a technical partner.

Confirm with counsel which national penalty rules apply in each Member State where you operate.

Article 99 penalties cost and effort questions

How much effort does preparing for an Article 99 penalty file take?

Effort depends less on the fine itself than on how much of your AI estate you can show to an authority quickly. The penalty file is built from the same evidence an authority would ask for: a complete inventory of AI systems, the role you hold for each (provider, deployer, importer or distributor), the risk classification and its reasoning, and the records that show which obligations you met. Effort rises with the number of systems, how many vendors supply them, and how scattered the records are across teams. Organizations with a current inventory and named owners usually need far less time to assemble a credible file. Confirm the workload with a written scope before any work starts.

Does the SME cap on AI Act fines apply to my company?

The lower cap applies only if your company qualifies as an SME, including a start-up, or, for certain fines, a small mid-cap enterprise. Under Article 99(6), each fine for an SME is capped at whichever of the fixed amount or the turnover percentage is lower. Regulation (EU) 2026/1744 extended this lower cap to small mid-caps for the paragraph 4 and 5 fines (Article 99(6a)). Qualification depends on headcount and turnover or balance sheet thresholds set in the EU recommendation on SME definitions, and group structure can change the answer. Check the definition with your legal counsel and the Article text on EUR-Lex before relying on the cap in any risk model.

Can our in-house team prepare the evidence for penalty exposure ourselves?

Yes, many organizations prepare the core evidence in-house, and that is often the most efficient route if the team already runs security and data governance processes. The work splits into three parts: documenting AI systems and roles, producing technical records such as data governance, logging and testing results, and proving that policies were applied in practice. Internal teams usually handle the first part well. The second and third parts often need engineering and legal time that competes with product work. An outside implementation partner can prepare systems, logging configurations and evidence packs, but the organization keeps ownership of its controls and decisions.

What does the work need from legal and engineering teams?

Legal and engineering own different halves of the file, and the work stalls when either side is missing. Legal typically decides the role you hold for each system, interprets the Article 99 factors as they apply to your business, and reviews any notices, contracts with suppliers and statements made to authorities. Engineering supplies the technical facts: where models run, what data they use, how logs are kept, how incidents are detected and how changes are controlled. Ask both teams to name an accountable owner and agree a single inventory as the source of truth before drafting begins.

How long does preparation usually take, stage by stage?

Preparation usually runs in stages rather than as a single fixed period. The first stage is scoping: building the AI system inventory and classifying each system. The second is gap analysis against the obligations that apply to your roles and dates. The third is remediation, where documentation, technical controls and contracts are changed. The fourth is evidence assembly and a review of the file by legal counsel. Timing depends on how many systems are in scope and which high-risk dates apply to them, and the dates in Article 113 as amended in 2026 should be checked against the current consolidated text. Ask any partner to break its timeline into these stages in writing.

Can a partner reduce the fine we might face?

A partner cannot promise a lower fine, and no one should sell a guarantee of one. Article 99(7) lists the factors an authority weighs, including gravity, duration, cooperation, measures taken, self-notification and mitigation. A partner can help you show good-faith effort by fixing gaps, documenting decisions and preparing evidence that you cooperated with authorities. Those factors are judged by the authority and, where relevant, a court. Your legal counsel should own any statement to a regulator. DeployOpen prepares systems, controls and evidence; it does not issue attestations, and it cannot influence how an authority decides.

How DeployOpen prepares systems and evidence for Article 99 readiness

DeployOpen helps organizations prepare the self-hosted systems, controls and evidence that an Article 99 penalty review would look at, inside the client's own infrastructure. We do not issue audit reports or certifications, and the organization remains responsible for its own compliance decisions.

How we scope

We agree a written scope that names the AI systems, providers or deployer roles, and Article 99 obligations covered before work starts.
Scope documents which fine tier each in-scope obligation falls under, so the readiness work matches the exposure.
Engagements are fixed-scope, with deliverables and timelines agreed in writing, and a quote follows from that scope.

How we build

We configure self-hosted platforms in your cloud accounts or data centers to log AI system decisions, changes and access.
We set up documented procedures for handling information requests from authorities so responses are consistent and traceable.
We test the evidence pipeline against the scoped obligations to confirm the records exist and can be retrieved on request.

How we hand over

You receive documentation covering the configured controls, the evidence each control produces, and where it is stored.
We walk your compliance and engineering staff through the records they will need to produce if an authority asks questions.
Handover includes a list of items to confirm with your legal counsel, since penalty exposure depends on your turnover and status.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Retainers can keep evidence collection current as your AI systems change or as the Act's dates and guidance are updated.
Questions about fine calculations, enforcement strategy or legal exposure should go to qualified counsel, which we can coordinate with.

Article 99 Penalties