The AI Act's top fine stays at 35 million euros until turnover passes 500 million

The tiers are written as the higher of a fixed amount or a percentage of global annual turnover, and for companies the higher figure applies ^[2]. So the number worth computing is the one where the two meet. At 7 percent, the 35 million euro ceiling is matched by turnover of 500 million euros ^[1]. At 3 percent, the 15 million euro tier crosses at the same 500 million ^[2]. The 1 percent tier for supplying incorrect or misleading information to authorities crosses at 750 million ^[3]. Below those lines, the fixed sum is the exposure ceiling and the percentage never binds.

GDPR's 20 million or 4 percent crosses at 500 million too ^[4]. Above that line, the AI Act's top tier takes 1.75 times the share of turnover that GDPR does ^[5].

For most engineering teams the scoping is the harder fact. Prohibited practices under Article 5 carry the 35 million or 7 percent tier and apply to any organization ^[5]. The high-risk tier and the Article 50 transparency tier both sit at 15 million or 3 percent, and both apply to providers and deployers ^[6]. A team that trains nothing and hosts nothing, and only wires a vendor model into a product, is in the same tier as the vendor for a labeling failure.

Two entries on the mitigating list have delivery dates attached. Voluntary disclosure counts only before enforcement action begins ^[9]. That requires finding your own non-compliance before a regulator does. Prompt corrective action counts within 30 days of notification ^[9]. Thirty days is short for a change that touches a model card, a UI string, a logging path and a published document, and shorter still if nobody owns all four.

The tier amounts and categories come from Article 99. The calculation methodology, the aggravating and mitigating lists, and the quarterly enforcement calendar come from a dev.to breakdown that attributes them to the European Commission, 2024 ^[16]. That same post states it was drafted with AI assistance and reviewed for factual accuracy, and that AI-origin labeling applies under Article 50 ^[15]. A breakdown of the labeling duty that carries its own origin label is at least internally consistent. Its text says enforcement begins on 2 August 2026, while its comparison table lists the Act as effective since August 2026, so treat the calendar as that publisher's reading rather than published AI Office guidance ^[3][17].

Nothing in the penalty structure names an artifact. It names duties, ceilings and the parties they reach ^[1][5][6]. The deliverable comes from the enforcement sequence the post describes: information requests and corrective action orders first, financial penalties after, with direct penalty proceedings available for intentional non-compliance or failure to cooperate ^[4]. An information request is answered with documents that already exist. Failure to engage with those requests is listed as Priority 2 for Q3-Q4 2026, behind GPAI models with systemic risk above 10^25 FLOPs ^[13]. High-risk obligations become enforceable in Q3-Q4 2027, about 16 months after enforcement opens ^[14][6].