What it carries

14 obligations in this collection carry a stated penalty. Each is given with its basis, because a figure without the provision behind it cannot be checked and should not be relied on. Where an instrument sets a ceiling as the greater of a fixed sum and a share of turnover, both limbs are shown. Nothing here is an assessment of any organisation's exposure: what a supervisor does in a particular case turns on matters no reference page can know.

The ceiling, and what sets it

• Article 5Prohibited AI practices

  €35 million or 7% of worldwide annual turnover, whichever is higher

  Article 99(3), the only paragraph reaching 7% and reaching nothing but Article 5 — Article 99(4) expressly excludes the practices laid down in Article 5 from its lower ceiling. Under Article 99(6) an SME pays the lower of the two figures. Note that the small mid-cap concession inserted by the Digital Omnibus in Article 99(6a) covers paragraphs 4 and 5 only, so an SMC gets no relief here.

• Article 6Classification rules for high-risk AI systems

  No direct ceiling; exposure is derivative

  Article 6 is not enumerated anywhere in Article 99. Misclassifying a system downward is fined through the provider obligations it causes to be missed — no conformity assessment, no declaration, no CE marking, no registration — each reachable at €15 million or 3% under Article 99(4)(a). The duties in Article 6(4) itself, to document a not-high-risk assessment and register it, sit outside the enumerated provider obligations and fall to the penalties Member States lay down under Article 99(1). Stating a Union-level ceiling for an Article 6 breach would assert an exposure the Regulation does not create.

• Article 9Risk management system

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a): a provider must ensure its high-risk system meets the Chapter III Section 2 requirements, and Articles 9 to 15 sit in that section. Neither Article 9 nor Article 15 is itself enumerated in Article 99(4) — the exposure runs through Article 16. Under Article 99(6) an SME pays the lower of the two figures rather than the higher. The 7% ceiling in Article 99(3) applies only to the prohibited practices in Article 5.

• Article 10Data and data governance

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a) — Article 10 sits in Chapter III Section 2 and is not itself enumerated in Article 99(4). A second and separate exposure runs through data-protection law where special-category data is processed outside the conditions the relocated derogation sets, which is a different regulator and a different ceiling. Articles 99(6) and 99(6a) give SMEs and small mid-caps the lower figure.

• Article 11Technical documentation

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Two routes, one ceiling. Article 99(4)(a) reaches the obligations of providers pursuant to Article 16, and Article 16(a) requires the system to comply with the Chapter III Section 2 requirements, in which Article 11 sits. Article 16(d) separately requires the provider to keep the documentation referred to in Article 18 — this file included, for ten years after the system is placed on the market — so a file that once existed and was not retained is reachable without any argument about its contents. Article 99(6) gives an SME the lower of the two figures, and Article 99(6a), inserted by the Digital Omnibus, extends that treatment to small mid-cap companies.

• Article 12Record-keeping

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a) — Article 12 sits in Chapter III Section 2 and is not itself enumerated in Article 99(4). The provider’s separate retention duty has a shorter route, being named inside Article 16 directly; the deployer’s equivalent is reached through Article 99(4)(e). Three parties, three provisions, one ceiling. Articles 99(6) and 99(6a) give SMEs and small mid-caps the lower figure.

• Article 13Transparency and provision of information to deployers

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a) — Article 13 sits in Chapter III Section 2 and is not itself enumerated in Article 99(4). The consequence worth noticing runs downstream: a deployer handed instructions that omit the oversight measures or the expected accuracy carries its own exposure under Article 99(4)(e) via Article 26, for a defect it did not create and frequently cannot see. Article 99(6) gives an SME the lower of the two figures, and Article 99(6a), inserted by the Digital Omnibus, extends that to small mid-cap companies.

• Article 14Human oversight

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a): a provider must ensure its high-risk system meets the Chapter III Section 2 requirements, and Article 14 sits in that section. Article 14 is not itself enumerated in Article 99(4). The deployer-side failure — no competent, trained, authorised person assigned — is a separate exposure at the same ceiling under Article 99(4)(e) via Article 26(2), and both can arise on one deployment. Articles 99(6) and 99(6a) give SMEs and small mid-caps the lower figure.

• Article 15Accuracy, robustness and cybersecurity

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(a), reached through Article 16(a): a provider must ensure its high-risk system meets the Chapter III Section 2 requirements, and Articles 9 to 15 sit in that section. Neither Article 9 nor Article 15 is itself enumerated in Article 99(4) — the exposure runs through Article 16. Under Article 99(6) an SME pays the lower of the two figures rather than the higher. The 7% ceiling in Article 99(3) applies only to the prohibited practices in Article 5.

• Article 26Obligations of deployers of high-risk AI systems

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(e), which names deployer obligations pursuant to Article 26 directly — no chain through Article 16 is needed, unlike most of the high-risk requirements. Under Article 99(6) an SME pays the lower of the two figures, and Article 99(6a), inserted by the Digital Omnibus, extends the same treatment to small mid-cap companies. Where the deployer is a public authority, Article 99(8) leaves the extent of any fine to national law.

• Article 27Fundamental rights impact assessment for high-risk AI systems

  Determined by national law

  Article 27 is not enumerated in Article 99(4). Exposure arises under the penalties each Member State lays down pursuant to Article 99(1), which must be effective, proportionate and dissuasive but vary by jurisdiction. Check the implementing law of the Member State in which the deployer operates rather than assuming the Union ceilings apply.

• Article 50Transparency obligations for providers and deployers of certain AI systems

  €15 million or 3% of worldwide annual turnover, whichever is higher

  Article 99(4)(g), which names the transparency obligations of providers and deployers under Article 50 directly — the only paragraph of 99(4) covering both roles in one line. Article 99(6) gives SMEs the lower of the two figures and Article 99(6a) extends that to small mid-cap companies. Since the penalty architecture has applied since 2 August 2025, the ceiling was available from the day the obligation attached.

• Article 72Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems

  No direct ceiling; exposure runs through the technical documentation

  Article 72 is not enumerated in Article 99 and, unlike most Chapter III Section 2 requirements, is not reachable through the provider obligations in Article 16 either. Direct exposure is under Article 99(1) — the penalties each Member State lays down, which must be effective, proportionate and dissuasive but vary by jurisdiction. The Union-level route is indirect: the monitoring plan is an Annex IV element, so its absence is a technical-documentation defect reachable at €15 million or 3% under Article 99(4)(a). Market surveillance measures, including withdrawal, are frequently the more consequential outcome.

• Article 73Reporting of serious incidents

  No Union ceiling for the general population; national penalties under Article 99(1)

  Article 73 is not enumerated in Article 99(4), and it sits in Chapter IX rather than Chapter III Section 2, so the Article 16(a) bridge that carries most provider duties does not reach it either. Direct exposure is therefore under Article 99(1), the penalties each Member State lays down, which must be effective, proportionate and dissuasive but vary by jurisdiction. One population is different: for operators subject to the AI Office under Article 75(1), the new Article 75c(4), inserted by the Digital Omnibus, makes infringement of any applicable provision — expressly including provisions not listed in Article 99(4) — subject to fines as referred to in Article 99(4). Market surveillance measures under Regulation (EU) 2019/1020, which the authority must consider within seven days of notification, are frequently the more consequential outcome.