The EU AI Act's teeth: top penalties reach €35 million or 7% of global turnover
As enforcement lands, the scale of the EU AI Act's penalties comes into focus: violations of the prohibited-practice rules can draw fines up to €35 million or 7% of global annual turnover, whichever is higher — above even the GDPR's ceiling. Meanwhile the Digital Omnibus deferred the hardest high-risk obligations to December 2027, splitting the calendar.
The 7% ceiling is the number that concentrates boardroom attention. Exceeding even GDPR's 4%, it makes a serious AI Act violation a material financial event for a global company, not a compliance line item. The tiered structure — 7% for prohibited practices, 3% for general-purpose-model breaches, lower for supplying wrong information — means the penalty scales with how fundamental the violation is.
The split calendar is the practical nuance. The Digital Omnibus deferred stand-alone high-risk obligations to December 2027, so the most demanding conformity requirements are delayed — but the prohibited-practice bans and the general-purpose duties are in force now, with the full penalty regime behind them. Reading 'AI Act delayed' as blanket relief is the trap; the finable parts arrived on schedule.
The strategic read is that Europe has made non-compliance genuinely expensive at exactly the moment US federal policy is fragmenting. A named regulator with a 7%-of-turnover hammer is a different environment than voluntary codes or state patchworks, and it forces any company selling into the EU to treat AI compliance as a top-tier legal risk rather than a product footnote.
StationX — AI regulations around the world: full 2026 breakdown → · Legalithm — AI regulation compared: EU, US, UK, China (2026) →