Which EU AI Act and GDPR fine tiers matter most for an AI team handling personal data
An AI team that builds or deploys systems on personal data should rank its work by the fine tier each obligation sits in, and the first step is knowing which regime carries the higher ceiling for a given breach. The AI Act has three Article 99 tiers: EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most operator obligations, and EUR 7.5 million or 1% for misleading information given to authorities, each applying whichever amount is higher. The GDPR has two tiers: EUR 10 million or 2% under Article 83(4) for controller and processor duties such as security of processing and breach notification, and EUR 20 million or 4% under Article 83(5) for principles, lawful basis, data subject rights and transfers, again whichever is higher. A single incident can therefore sit under both regimes at once, and the exposure is driven by which obligation was breached, not by the regulation's name.
Three variables move the real number. Turnover matters because both regimes use a percentage of worldwide annual turnover, so for a large group the percentage cap can exceed the fixed amount. The SME rule matters because Article 99(6) makes the lower amount apply to SMEs under the AI Act, which changes the calculation for smaller providers. The enforcing authority matters because national market surveillance authorities enforce the AI Act for most AI systems, while the Commission's AI Office takes the general-purpose model rules and, under Article 75(1) as amended in 2026, certain systems built on a provider's own general-purpose model. GDPR fines come from independent national supervisory authorities. Confirm with counsel which authority will supervise each system in your portfolio.
The 2026 amendment, Regulation (EU) 2026/1744, changed the AI Act timeline and its scope, so check the consolidated text before ranking any obligation. The GDPR text has not been amended as of October 2026, although the Omnibus IV and Digital Omnibus proposals are still moving through the legislative process. Practically, rank your work in three steps: list every prohibited or high-risk use and the data it touches, map each obligation to its tier, then fund first the controls whose breach carries the 7% or 4% ceilings. Ask your legal team to confirm each fine calculation against your group turnover and SME status in writing.
How the AI Act and GDPR fine tiers line up
This table places the AI Act's three fine tiers in Article 99 and the separate Commission fine for general-purpose AI model providers in Article 101 beside the two GDPR tiers in Article 83. Read each row as the maximum for a breach, then match each of your obligations to its tier to rank remediation work. The main takeaway: the AI Act's top cap is higher, but the GDPR already applies to personal data processing, while the AI Act's obligations phase in on dates set by Article 113.
| Item | EU AI Act (Regulation 2024/1689) | GDPR (Regulation 2016/679) |
|---|---|---|
| Top tier cap | EUR 35 million or 7% for prohibited practices (Art 99; Art 5 list) | EUR 20 million or 4% for principles, lawful basis, data subject rights and transfers (Art 83(5)) |
| Middle tier cap | EUR 15 million or 3% for most operator obligations, including high-risk provider duties (Art 99; Art 16) | EUR 10 million or 2% for security, breach notice, DPIAs, processors and records (Art 83(4)) |
| Lowest tier cap | EUR 7.5 million or 1% for misleading information given to authorities (Art 99) | None. The GDPR has two tiers only. |
| Turnover basis | Worldwide annual turnover; the higher figure applies | Total worldwide annual turnover of the preceding financial year; the higher figure applies (Art 83) |
| SME rule | For SMEs the lower of the two figures applies (Art 99(6)) | No lower SME cap in Article 83; confirm the position with counsel for your entity size |
| Separate fine for general-purpose AI model providers | Commission may fine up to 3% or EUR 15 million, whichever is higher (Art 101) | No equivalent provision |
| Who enforces | National market surveillance authorities; AI Office for general-purpose AI rules (Art 88) | Independent national supervisory authorities (Art 51); EDPB settles cross-border disputes (Art 65) |
| Ranking tip | Place each AI duty in a tier first; prohibited practices sit at the top | Place each processing duty in a tier; security and breach duties sit in the middle |
How the three AI Act tiers and two GDPR tiers are set
Both regimes set maximum fines as a fixed euro amount or a percentage of total worldwide annual turnover, and in each case the higher of the two applies. The AI Act's SME rule reverses this for small and medium enterprises: under Article 99(6), the lower of the two figures applies, so a smaller company's exposure is capped by the smaller number. Under Article 99(4), the most serious tier covers prohibited practices at EUR 35 million or 7% of turnover, the middle tier covers most operator obligations at EUR 15 million or 3%, and the third tier covers misleading information given to authorities at EUR 7.5 million or 1%. Under Article 101(1), the Commission may fine providers of general-purpose AI models up to EUR 15 million or 3% of annual total worldwide turnover in the preceding financial year, whichever is higher, for intentional or negligent infringements. The GDPR works on two tiers. Article 83(4) sets EUR 10 million or 2% for controller and processor duties such as security of processing, breach notification and data protection impact assessments, while Article 83(5) sets EUR 20 million or 4% for principles, lawful basis, data subject rights and transfers.
These figures are maximums, not typical fines. The regulator sets the actual amount case by case, and the legal text lists factors such as the nature, gravity and duration of the infringement, and whether the organization acted deliberately or negligently. Treat the caps as a ceiling for scenario planning. Ask your counsel to confirm how the turnover base is measured for your corporate group, and which entity in a group the fine would attach to, before you put a number in a board paper. For the SME rule, confirm with counsel whether your organization meets the SME definition in EU law and how that status is determined in your case.
To rank work by exposure, start by mapping each AI system you provide or deploy to the Article 99 tier of the obligation it could breach, then to the Article 83 tier of any personal data processing around it. A prohibited practice carries the highest AI Act ceiling, so confirm early that no use case falls into that category. Records, logging and governance tasks that look administrative may still sit in a mid-level tier. Because the GDPR caps for security and breach duties are lower than the caps for lawful basis and transfers, compare the tiers against the likelihood of each failure in your environment, not only the headline figures.
What moves your fine exposure up or down
Fine ceilings under both regimes scale with worldwide annual turnover, but the tier that applies depends on which obligation is breached, your role and whether personal data is involved. Work through these drivers in order to rank compliance work by exposure.
Worldwide annual turnover
Both regimes set the ceiling as a percentage of total worldwide annual turnover, or a fixed amount, whichever is higher. For a large group, the percentage usually sets the ceiling, so turnover of the preceding financial year drives the number. Confirm which group entity and which financial year your counsel treats as the reference point, since the group definition affects the figure. Check whether your fixed-amount cap or your percentage cap is the larger one at your size.
SME status
Article 99 applies the lower of the two amounts for SMEs, so the fixed cap or the percentage cap that is lower becomes the ceiling. Under the GDPR, the higher-of rule has no equivalent SME reduction in the supplied tiers, so the same company can face very different ceilings under each regime. Confirm your SME status against the EU definition and document it before you rank exposure.
Which obligation is breached
The tier follows the obligation, not the size of the incident. Prohibited AI practices sit in the top AI Act tier, most operator duties sit in the middle tier, and GDPR principles and data subject rights sit in the higher GDPR tier. Map each control gap to its article before ranking, because a single failure, such as an unlawful processing basis, can trigger the top GDPR tier while the same system's documentation gaps fall lower.
Provider, deployer or both
The AI Act places most high-risk duties on providers, while deployers carry their own operator duties. An organization that builds a system and then runs it internally holds both roles, so exposure stacks. Confirm your role for each AI system in your inventory, because the obligations and the tier that applies to each breach differ between roles. The role question is separate from whether you also act as a GDPR controller or processor.
General-purpose AI model provider
Article 101 lets the Commission fine providers of general-purpose AI models separately, up to 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher, for intentional or negligent infringements. This exposure sits outside the national market surveillance route. Ask whether your model is placed on the EU market and whether any system built on it is one you control, since the Commission's role also covers certain systems built on a provider's own model.
Personal data in the AI pipeline
Once an AI system processes personal data, the GDPR tiers apply in parallel with the AI Act tiers, so one incident can produce two sets of fines from two authorities. Identify which training, testing, input and output datasets contain personal data, and whether your lawful basis and transfer mechanism are documented for each. Lawfulness and transfer failures sit in the higher GDPR tier, so these checks rank first for most teams.
Which obligations sit in which fine tier
Providers of high-risk AI systems carry the provider duties in Article 16. Breaches of most operator obligations fall in the middle tier of Article 99: up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. Exposure starts when the rules apply to each system, so the date matters as much as the tier.
- Article 16 duties: Provider obligations for high-risk systems sit in the EUR 15 million or 3% tier. Confirm with counsel which sub-clause maps to each internal task.
- Article 23 importers: Importers placing systems on the EU market face the same middle tier for their listed duties. Confirm which importer obligations map to Article 23 before ranking them.
- Misleading information: Supplying misleading information to authorities or notified bodies falls in the lowest tier: EUR 7.5 million or 1%.
- Application dates: After the 2026 amendment, Annex III systems are covered from 2 December 2027 and Annex I product systems from 2 August 2028.
Check whether each system is listed in Annex III or Annex I, then confirm the article-level mapping with counsel before ranking the work.
Deployers in the EU, meaning organizations that use AI systems under their own authority, face the operator tiers in Article 99. Most operator obligations sit in the middle tier, while prohibited practices sit at the top. Deployer duties use different article numbers from provider duties, so each one needs its own mapping rather than a copy of the provider list.
- Prohibited practices: Any operator that engages in a prohibited practice faces the highest tier: EUR 35 million or 7% of total worldwide annual turnover, whichever is higher.
- Operator obligations: Most deployer duties for high-risk systems fall in the EUR 15 million or 3% tier. Confirm the specific deployer articles with counsel.
- Transparency duties: Transparency obligations are operator duties under Article 99. Ask counsel for the exact article reference and which tier it carries.
- SME rule: For SMEs, Article 99(6) applies whichever of the two amounts is lower, which changes the ceiling for smaller deployers.
Ask counsel to list each deployer duty that applies to your systems, confirm its tier, and record the result alongside your GDPR records.
Providers of general-purpose AI models face a separate fine regime. Article 101 lets the Commission fine them up to 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher, for intentional or negligent infringements. The fine is set at EU level, not by a national authority.
- Who enforces: The Commission's AI Office enforces the general-purpose AI model rules under Article 88. National market surveillance authorities enforce the Act for AI systems.
- Own-model systems: Under Article 75(1) as amended in 2026, the Commission is exclusively competent for AI systems built on a provider's own general-purpose model. A provider may face Commission oversight for that system.
- Intent or negligence: Article 101 covers both intentional and negligent infringements, so the internal record of good-faith steps matters.
- Application date: Confirm with counsel when Article 101 applies, because the phasing in Article 113 places it within the later application window.
Identify whether your organization is a model provider, a system provider building on its own model, or a downstream provider, because each role changes which authority can fine you.
The GDPR sets two administrative fine tiers in Article 83. Article 83(4) covers controller and processor duties with a maximum of EUR 10 million or 2%, and Article 83(5) covers principles, lawful basis, data subject rights and transfers with a maximum of EUR 20 million or 4%, whichever is higher in each case. Independent national supervisory authorities enforce these tiers.
- Security and breach duties: Article 32 on security of processing, and Articles 33 and 34 on breach notification, sit in the 2% tier under Article 83(4).
- Lawful basis and principles: Articles 5, 6, 7 and 9 sit in the 4% tier, as do data subject rights in Articles 12 to 22, including automated decisions under Article 22.
- Transfers: Articles 44 to 49 sit in the 4% tier, which matters when an AI vendor processes EU personal data outside the EEA.
- Processor duties: Article 28 falls within the Articles 25 to 39 range of the 2% tier. Confirm the processor-specific mapping with counsel.
Map each AI data flow to these articles with counsel, because one incident can engage both the GDPR and the AI Act, and certification under Article 42 does not reduce either responsibility.
How to rank compliance work by exposure
This sequence turns a broad list of AI Act and GDPR duties into a ranked work plan, so the obligations carrying the highest fine tier and the weakest evidence get attention first. Each step produces a record that the next step relies on.
Inventory AI systems and personal data flows
Start by listing every AI system you provide or deploy in the EU, including systems built on a third-party general-purpose model, and every personal data flow that feeds or results from them. Record the system owner, the purpose, the data categories and where each dataset is processed. Involve product, data protection and procurement, since each team usually knows a different part of the picture. The step is done when every system and data flow has one owner and a single inventory entry, and when gaps are listed as open questions rather than assumed away.
Classify each obligation by its fine tier
For each inventory entry, map the duties that apply to it to a tier. Under Article 99 of the AI Act, prohibited practices sit in the highest tier, most operator obligations in the middle tier, and misleading information to authorities in the lowest. Under Article 83 of the GDPR, security, breach notification, impact assessments and processor duties fall in the lower tier, while principles, lawful basis, data subject rights and transfers fall in the higher tier. Mark any obligation that appears under both regimes so it is not counted twice. The output is a tiered register that a legal reviewer can check line by line.
Check turnover basis and SME status
For each entity in the group, confirm which turnover figure applies to the maximum fine calculation and whether the SME rule could lower the ceiling for that entity. Under Article 99(6) of the AI Act, the lower of the two amounts applies to SMEs, while the higher amount applies otherwise. Confirm the preceding financial year figure with finance, and confirm group structure with legal counsel, because the calculation is based on worldwide annual turnover. Write down the ceiling that applies to each entity and tier, so the exposure comparison uses the same base for every obligation.
Identify the enforcing authority for each obligation
Name the authority that would act on each obligation. For AI systems, national market surveillance authorities enforce the AI Act, while the Commission's AI Office enforces the general-purpose AI model rules and, under Article 75(1) as amended in 2026, holds exclusive competence for AI systems built on a provider's own general-purpose model and for AI in very large online platforms and search engines. For personal data, the independent national supervisory authority in each Member State enforces the GDPR, and cross-border cases can reach the European Data Protection Board. Confirm the authority in each Member State where you operate, since national designations determine the practical contact point.
Score exposure where the highest tier meets weak evidence
Combine the tier, the ceiling and the authority into one ranking, then check the evidence each obligation can currently produce. The highest priority sits where a top-tier duty meets thin documentation, such as a prohibited-practice screen without a written record or a high-risk system without a technical file that could support a conformity assessment. Lower-tier gaps with strong evidence can wait. Note that the AI Act's high-risk rules apply from 2 December 2027 for Annex III systems, so plan that work against that date while still addressing current GDPR duties that already apply. The output is a ranked backlog with a named owner and a stated evidence gap for each item.
Questions buyers ask about EU AI Act and GDPR fines
Do EU AI Act fines stack with GDPR fines for the same incident?
They can apply in parallel, because each regulation sets its own ceiling and its own enforcement body. Article 99 of the AI Act and Article 83 of the GDPR each cap fines on their own terms. The AI Act is enforced by national market surveillance authorities for AI systems and by the Commission's AI Office for general-purpose AI model rules. The GDPR is enforced by independent national supervisory authorities. One incident that breaches both could lead to two proceedings. Whether a regulator pursues both, and how it sizes each penalty, depends on the facts and on that authority's practice. Confirm this with counsel for your specific systems. For planning, the more useful question is which obligations trigger each regime, because that determines where your exposure sits. The GDPR text on EUR-Lex is the primary source for the Article 83 caps.
What drives the cost and effort of getting ready for the AI Act?
The main drivers are how many AI systems you run, whether any fall into the high-risk categories, and how much personal data they use. Each of these changes the number of obligations and the amount of evidence you need. Your existing GDPR program also matters, because records of processing, impact assessments and breach procedures can be reused. The cost components are usually internal staff time, legal review, technical testing and, if you hire one, an implementation partner. Most of this work is one-time, such as classifying systems, building documentation and running the first assessments. Some is recurring, such as monitoring, updates after model changes and periodic review. Ask any provider to break the quote into these components and to state which items recur after go-live. The supplied facts do not give a cost figure for this work, so the quote is the only reliable source for your numbers.
Does a small or medium enterprise get a lower fine cap under the AI Act?
For the AI Act, yes. Article 99 applies the lower of the two amounts to SMEs instead of the higher, so the ceiling for breaches of most operator obligations is the lower of EUR 15 million or 3% of total worldwide annual turnover. Check SME status against the Act's definitions, because it depends on headcount and turnover and on the company's group structure. The GDPR is different in the supplied facts. Article 83 sets its caps as the higher of the two amounts, and the supplied facts describe no separate SME rule for it. Confirm that point with a data protection lawyer before you plan around it. A lower cap reduces the maximum penalty, but the obligations stay exactly the same, so a small company still needs the same documented controls for the systems it runs.
What does a regulator fine not prove about a company?
A fine proves that a regulator found an infringement and set a penalty for it. It does not prove that your whole program is sound, and it does not show that you hold a certificate. Neither regulation issues a certificate of compliance. Under the GDPR, Article 42 certification is voluntary, lasts for at most three years and does not reduce the controller's or processor's responsibility. The AI Act's conformity assessment for most Annex III systems is an internal control procedure. The absence of a fine proves little either. No enforcement action means no decision has been made, not that a company has been cleared. Use fine tiers to rank where your exposure is largest, then use evidence such as risk assessments, records, test results and incident logs to show what you actually did.
How long does it take to prepare for the EU AI Act?
The supplied dates set the deadlines, but they do not tell you how long your own preparation will take. Chapters I and II have applied since 2 February 2025, and the general-purpose AI, governance, notified body and penalty chapters have applied since 2 August 2025, except Article 101. The rest of the Act applies from 2 August 2026. As amended in 2026, the high-risk rules for Annex III systems apply from 2 December 2027, and those for Annex I product systems apply from 2 August 2028. Duration depends on the number of systems, the state of your documentation and how much testing you must do. Ask for a timeline built from your own system inventory, and check it against the dates above, which come from the consolidated text on EUR-Lex.
What should a fixed-scope quote for AI Act readiness include?
A fixed-scope quote should name the systems in scope, the obligations covered and the deliverables, with each one tied to a written acceptance step. Ask for the assumptions behind the price and the timeline, such as the number of systems, access to data and staff availability. Ask what is excluded, including any legal opinion, certification or audit, because DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies do. Confirm who owns the documentation after handover, how changes to scope are priced and whether ongoing support or testing is a separate retainer. The AI Act overview from the European Commission is a useful reference for checking that the scope covers the right articles. DeployOpen does not publish a price list, so the written scope is the basis for any quote.
How do I tell which fine tier applies to a given obligation?
Start with the article the obligation comes from, then match it to the tier. Under Article 99 of the AI Act, prohibited practices carry the highest tier, up to EUR 35 million or 7% of worldwide annual turnover. Most operator obligations fall in the middle tier, up to EUR 15 million or 3%. Misleading information given to authorities falls in the lowest tier, up to EUR 7.5 million or 1%. Under the GDPR, Article 83(4) covers controller and processor duties such as security, breach notification, impact assessments and records, with a cap of EUR 10 million or 2%. Article 83(5) covers principles, lawful basis, data subject rights, transfers and supervisory orders, with a cap of EUR 20 million or 4%. Rank your work by the higher tier first, then by how many systems each obligation touches. Confirm the mapping for your own systems with counsel.
What to confirm in your own environment before ranking
Before you rank obligations by exposure, confirm the inputs that set the fine ceiling. The Article 99 and Article 83 caps are the higher of a fixed amount or a percentage of total worldwide annual turnover for the preceding financial year, so the percentage only means something once someone has calculated that figure. Ask finance which turnover base applies, whether it is the consolidated group or a single legal entity, and how intra-group revenue is treated. Then confirm group structure: if the AI system is developed by one entity, sold by another and deployed by a third, each may face a different regulator and a different cap. The sources do not answer these questions for your corporate tree, and the SME rule only helps if your enterprise status is confirmed under the Commission's criteria.
Next, classify each system. Confirm whether it falls under Annex III (high-risk use cases) or Annex I (product legislation), because the 2026 amendment moved the application dates for those two categories to 2 December 2027 and 2 August 2028 respectively, and the conformity route differs. Determine your role for each system (provider, deployer, importer or distributor) and whether a general-purpose AI model sits underneath, since that can bring the AI Office into the picture under Article 101. Also confirm which national market surveillance authority will supervise you, and which data protection authority covers your establishment for GDPR purposes. Those authorities may differ, and the sources do not tell you which one a given member state has designated.
Finally, track the two procedures that could move the GDPR side of this comparison. Omnibus IV (procedure 2025/0130(COD)) has a text agreed in interinstitutional negotiations on 26 June 2026 that still awaits Parliament's first-reading vote, and the Digital Omnibus (procedure 2025/0360(COD)) is awaiting committee decision. Check the European Parliament Legislative Observatory) for each file before you lock the GDPR tier mapping into a risk register, and record the date you last verified the status. Ask your privacy counsel to confirm whether any change would alter the Article 83 tiers that apply to your processing. Do not assume the current text will hold.
How DeployOpen helps teams rank AI and GDPR exposure
DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, and prepares the systems, controls and evidence that an exposure ranking depends on. We do not issue audit reports, attestations or certifications; independent auditors and certification bodies do. Work starts only after scope, deliverables and timelines are agreed in writing.
How we scope
- The written scope lists which AI systems, data flows and processing activities are included in the exposure review.
- Scope names the obligations to be ranked by fine tier, with the owner for each control or document.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.
How we build
- We map where personal data enters AI systems and where logs, training inputs and outputs are retained.
- We set up the technical controls for security of processing, access and records in the client's own environment.
- Security testing of applications, APIs and AI systems can run against the same scope to check controls in practice.
How we hand over
- Handover includes the exposure register, control evidence and documentation mapped to each obligation tier.
- We document the assumptions behind each ranking so the client's counsel and auditors can review them.
- Clients receive the configuration, runbooks and records they need to keep the ranking current after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement.
- Retainers can cover re-ranking when the AI Act application dates or the GDPR text change, as confirmed with counsel.
- Questions on legal interpretation stay with the client's legal advisers; we confirm the technical facts they rely on.
Sources and further reading
- Regulation (EU) 2024/1689 (AI Act), Article 99, EUR-Lex ↗
- Regulation (EU) 2024/1689 (AI Act), Article 101, EUR-Lex ↗
- Regulation (EU) 2016/679 (GDPR), Articles 58, 82, 83 and 84, EUR-Lex ↗
- Regulation (EU) 2024/1689, consolidated text as amended by Regulation (EU) 2026/1744, EUR-Lex ↗
- Regulation (EU) 2025/2518 on the enforcement of Regulation (EU) 2016/679, EUR-Lex ↗
- European Parliament Legislative Observatory: procedure 2025/0360(COD), Digital Omnibus ↗
