AI Act fine calculator: the amounts in art. 99

Art. 99 sets, for each type of infringement, a fixed amount in euros and a percentage of worldwide annual turnover: up to €35,000,000 or 7% for the prohibited practices of art. 5 (art. 99.3); up to €15,000,000 or 3% for the remaining obligations (arts. 16, 22 to 26, 31, 33, 34 or 50, art. 99.4); and up to €7,500,000 or 1% for supplying incorrect, incomplete or misleading information to a notified body or competent authority (art. 99.5). The applicable amount is the one that results from comparing the fixed figure with the percentage of your turnover. Regulation (EU) 2026/1744 added to paragraph 4 aletra d bis), which adds to that band the breach of the obligations of providers and operators under art. 25, paragraphs 2 and 4.

The art. 99.3 band (prohibited practices under art. 5) is the most serious and admits no compliance plan. The art. 99.4 band covers the breach of the operational obligations of the provider, importer, distributor or deployer, and of the transparency duties of art. 50. The art. 99.5 band is the mildest of the three and specifically punishes giving incorrect, incomplete or misleading information to a notified body or to a competent national authority that requested it.

Art. 99, paragraph 6, is discretionary: its literal wording is that «each of the fines referred to in this article may be by the percentage or the amount referred to in paragraphs 3, 4 and 5, whichever is lower». For SMEs and start-ups, therefore, paragraph 6 allows the fine to be by the percentage or by the amount, whichever is lower: it is a power of the authority, not an automatic right to the lower figure. All other companies get the HIGHER of the two.

Yes. What this tool works out is the legal cap, not the amount the authority would finally impose. Art. 99.7 requires weighing, among other factors, the nature, gravity and duration of the infringement, the degree of cooperation with the authorities, the degree of responsibility of the operator taking into account the technical and organisational measures adopted, whether there was intent or negligence, and the actions taken to mitigate the harm. A certified AI management system (ISO/IEC 42001) is direct evidence of those organisational measures.

Not yet, and it is worth putting this precisely: as at 30 July 2026 there is no Spanish act or royal decree in force that formally designates the market surveillance authority under art. 70 of the AI Act, nor that sets out the national penalty procedure. AESIA (the Spanish Agency for the Supervision of Artificial Intelligence) does exist — its creation is authorised by Act 22/2021 and Act 28/2022, Royal Decree 729/2023 of 22 August approves its Statute, and it is based in A Coruña — but its designation as the AI Act market surveillance authority is not yet law in force. What does exist is the Draft Organic Act on the good use and governance of artificial intelligence (file 121/000096, XV Legislature), published in the Congress Official Gazette, Series A, no. 97-1, of 12 June 2026 and, as at 30 July 2026, at the amendment stage in the Committee on Economic Affairs, Trade and Digital Transformation with the deadline extended to 9 September 2026: it is not published in the BOE, it has no force of law and its text may change. That draft carries over the same three amounts from European art. 99 and adds a fourth category of minor infringements (up to €500,000 or 0.5% of total worldwide turnover, whichever is higher) that the Regulation does not provide for. And it does not designate AESIA as the sole authority: it shares market surveillance between AESIA and other supervisors — among them the Spanish Data Protection Agency, the General Council of the Judiciary, the Bank of Spain and the Directorate-General for Insurance and Pension Funds — depending on the type of system. The final allocation of powers depends on that act being passed.

No. It works out the legal cap from the data you enter, but it does not analyse your technical documentation, your real degree of cooperation with the authorities or the mitigating circumstances of your specific case. Check your situation with the AI Act Compliance service from Summum Consultoría before acting.