EU AI Act Penalties: What 3% Turnover Really Means

The Headline Penalty

EU AI Act Article 99(4)(g) sets the penalty for Article 50 violations:

> Up to €15,000,000, or up to 3% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

This is the same penalty tier as prohibited AI practices (Article 5) and the broad AI literacy obligation (Article 4). It's one tier below the most serious violations (prohibited practices can hit 7%).

For most companies, the 3% figure is the binding one. A SaaS doing $20M ARR could face a $600K fine. A retailer doing €100M in EU sales could face €3M.

How "3% of Turnover" Is Calculated

The AI Act references the "preceding financial year" — meaning your last completed fiscal year before the violation.

Key details:

• "Total worldwide annual turnover" — not EU-only. Your global revenue counts.
• "Whichever is higher" — the authority takes the larger of €15M or 3% of your global revenue.
• Per-violation — separate incidents can theoretically stack, though enforcement practice is still emerging.

For a €1M/year company, the 3% figure is €30K — much less than €15M. So the €15M floor only bites very large companies.

For a €500M+ global company, the 3% is €15M, so the two converge. For everyone in between, the percentage rule dominates.

What's Actually Enforced

The penalty is set by Article 99, but enforcement sits with national market surveillance authorities in each EU member state. These are typically:

• Germany's BNetzA / Federal Network Agency
• France's CNIL / DGCCRF
• Italy's AgID / Garante
• Spain's AESIA
• Netherlands' AP (Autoriteit Persoonsgegevens)

These authorities investigate complaints, conduct audits, and issue fines. The European AI Office (established February 2024) coordinates cross-border enforcement.

Realistic enforcement pattern:

1. Complaint triggers investigation. A user, competitor, journalist, or NGO files a complaint.

2. Authority requests documentation. They ask for your Article 50 disclosures, audit trail, technical implementation.

3. Notice to comply. If you're non-compliant, they issue a notice with a deadline (typically 30-90 days).

4. Penalty if ignored. If you don't comply after notice, the penalty kicks in.

The most common outcome for first-time, good-faith non-compliance is the notice — not the fine. But the fine is the stick that makes the notice effective.

Which AI Act Provisions Trigger the 3% Penalty

Article 99(4)(g) covers several obligations:

• Article 50 transparency obligations
• Article 4 AI literacy
• Article 5 prohibited practices (in some interpretations)
• Provider obligations for general-purpose AI (Article 53)
• Various deployer obligations in Chapter 4

For this article's focus: Article 50 violations are squarely in the 3% tier.

How to Minimize Your Risk

1. Generate Your Disclosure Now

The single highest-leverage action. Use our [Article 50 generator](/generate) to produce compliant text, the HTML widget, and a PDF audit record. Time: 30 seconds. Cost: free.

2. Document Everything

Keep records of:

• When you deployed the AI feature
• What the disclosure said
• Who approved the disclosure
• When you updated the AI model

A PDF generated by our tool is sufficient for most audit requests. For larger companies, formal compliance documentation under ISO/IEC 42001 is recommended.

3. Stay Current

The EU AI Act has delegated acts and implementing regulations still being finalized through 2026-2027. Subscribe to the EU AI Office's newsletter or join industry groups tracking implementation.

4. Watch for Code of Practice Updates

The Code of Practice on Transparency (published 10 June 2026) is the authoritative guidance for Article 50 implementation. Updates will refine best practices.

5. For B2B Platforms: Provide Disclosures to Customers

If you sell AI services to businesses, help them comply. Provide API endpoints that return compliance text, offer widget snippets, and document your own Article 50 status.

What the Penalty Doesn't Cover

The 3% penalty tier doesn't apply to:

• High-risk AI system violations (Article 16 et al.) — those can hit 15M or 1%
• Prohibited practices (Article 5) — 15M or 7%
• Most general-purpose AI provider obligations — separate tier

Article 50 is "middle tier" — serious enough to deter, low enough that most companies can comply with modest effort.

Realistic Risk Assessment

For most companies:

• Complaint probability: Low, unless you have a visible AI feature with poor disclosure
• Investigation probability if complained: Medium-High (authorities have to investigate complaints)
• Fine probability after investigation: Low, if you cooperate and fix
• Fine size if it happens: 0.5%-1% of global turnover typically, not the full 3%

The actual risk-adjusted cost of non-compliance is much lower than 3%. But the actual cost of compliance is also low — minutes of work with our generator. The math favors compliance.

CTA: Eliminate Your Penalty Risk

Our [Article 50 generator](/generate) produces the disclosure, widget, and PDF audit record in 30 seconds. The 3% penalty doesn't apply if you can demonstrate compliance.

[Generate My Disclosure Now →](/generate)

*This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for your specific compliance needs.*