What it carries

4 obligations in this collection carry a stated penalty. Each is given with its basis, because a figure without the provision behind it cannot be checked and should not be relied on. Where an instrument sets a ceiling as the greater of a fixed sum and a share of turnover, both limbs are shown. Nothing here is an assessment of any organisation's exposure: what a supervisor does in a particular case turns on matters no reference page can know.

The ceiling, and what sets it

• Article 9Risk management system

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a): a provider must ensure its high-risk system meets the Chapter III Section 2 requirements, and Articles 9 to 15 sit in that section. Neither Article 9 nor Article 15 is itself enumerated in Article 99(4) — the exposure runs through Article 16. Under Article 99(6) an SME pays the lower of the two figures rather than the higher. The 7% ceiling in Article 99(3) applies only to the prohibited practices in Article 5.

• Article 15Accuracy, robustness and cybersecurity

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a): a provider must ensure its high-risk system meets the Chapter III Section 2 requirements, and Articles 9 to 15 sit in that section. Neither Article 9 nor Article 15 is itself enumerated in Article 99(4) — the exposure runs through Article 16. Under Article 99(6) an SME pays the lower of the two figures rather than the higher. The 7% ceiling in Article 99(3) applies only to the prohibited practices in Article 5.

• Article 26Obligations of deployers of high-risk AI systems

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(e), which names deployer obligations pursuant to Article 26 directly — no chain through Article 16 is needed, unlike most of the high-risk requirements. Under Article 99(6) an SME pays the lower of the two figures, and Article 99(6a), inserted by the Digital Omnibus, extends the same treatment to small mid-cap companies. Where the deployer is a public authority, Article 99(8) leaves the extent of any fine to national law.

• Article 27Fundamental rights impact assessment for high-risk AI systems

  Determined by national law

  Article 27 is not enumerated in Article 99(4). Exposure arises under the penalties each Member State lays down pursuant to Article 99(1), which must be effective, proportionate and dissuasive but vary by jurisdiction. Check the implementing law of the Member State in which the deployer operates rather than assuming the Union ceilings apply.