Sanctions

To ensure that the prohibitions and obligations set out in the AI Act are also complied with, regulations are needed to ensure enforcement. In the form known at EU level, Member States must ensure that the sanctions provided for must be "effective, proportionate and dissuasive". Possible forms include sanctions and other enforcement measures such as warnings and non-monetary measures. The imposition of fines is an essential part of this package of sanctions. The offences and the maximum fines are specified by the AIA.

The following maximum fines may be imposed for the following violations (see Art. 99, 101 AIA):  

• Up to EUR 35 million or 7 per cent of the previous year's total worldwide turnover (whichever is higher) for non-compliance with the prohibited practices;
• Up to EUR 15 million or 3 per cent of the previous year's total global turnover (whichever is higher) for breaches of obligations that conformity assessment bodies and the relevant stakeholders must comply with;
  • Providers of high-risk AI systems, AI systems with limited risk, GPAI models;
  • Deployers of high-risk AI systems and AI systems with limited risk;
  • Authorised representative;
  • Importer;
  • distributor;
• Up to EUR 7.5 million or 1.5 per cent of the previous year's total worldwide turnover (whichever is higher) for providing incorrect, incomplete or misleading information to conformity assessment bodies or competent national authorities in response to their request for information.

As the EU institutions, bodies, offices and agencies should lead by example, they are also subject to the rules and possible sanctions. The following maximum fines can be imposed for the following infringements (see Art. 100 AIA):

• Up to EUR 1.5 million for non-compliance with prohibited practices;
• Up to EUR 750 000 in case of non-compliance of the AI-system with requirements or obligations laid down in this Regulation.

Who is authorised to impose fines depends on who has been delegated supervision. In principle, it is national authorities that are authorised to impose fines (see Art. 99 AIA). In the case of providers of GPAI models, the Commission may impose fines (see Art. 101 AIA); in the case of violations of the AIA by EU institutions, bodies, offices and agencies, the European Data Protection Supervisor is authorised to do so (see Art. 100 AIA). 

When considering whether and/or to what extent a fine should be imposed, the following aspects, among others, should be taken into account (see Art. 99 para. 7 AIA):

• the nature, gravity and duration of the infringement and its consequences, taking into account the purpose of the AI system and, where applicable, the number of persons concerned and the extent of the harm suffered by them;
• whether the same operator has already been fined by other market surveillance authorities for the same infringement or has been fined by other authorities for infringements of Union or national law where those infringements result from the same act or omission constituting a relevant infringement of this Regulation;
• Size, annual turnover and market share of the actor who committed the offence;
• Intentional or negligent nature of the offence;
• etc.

In the case of EU institutions, bodies, offices and agencies, special reasons must be considered (see Art. 100 para. 1 AIA for more details).