EU AI Act penalties: what missing AI literacy actually costs
Temja·July 28, 2026· 7 min read
the short version
- →The fines live in Article 99. They reach up to 35 million EUR or 7 percent of worldwide turnover, whichever is higher.
- →The AI literacy duty in Article 4 sits in the middle tier: up to 15 million EUR or 3 percent of turnover.
- →The figures are maximums. Authorities weigh severity, duration, cooperation, and what you had already done. A real programme changes the conversation.
- →National authorities supervise and enforce Article 4 from 2 August 2026. The duty itself has applied since February 2025.
Most compliance texts go vague when money comes up. The EU AI Act does not. Article 99 puts numbers on the table, and it anchors them to worldwide annual turnover, the same construction GDPR made familiar. The intent is plain: breaking the rule must cost more than following it. Here is how the tiers are built, where the literacy duty that touches almost every company actually sits, and what an authority looks at before any number is written down.
Three tiers of fines
Article 99 sorts breaches into three levels. Prohibited practices sit at the top. Most substantive obligations, including the Article 4 literacy duty, sit in the middle. Supplying wrong or misleading information to an authority has its own, lower tier.
| Breach | Maximum fine | Or share of turnover |
|---|---|---|
| Prohibited practices (Article 5) | 35 million EUR | 7 percent |
| Most obligations, including Article 4 | 15 million EUR | 3 percent |
| Incorrect information to authorities | 7.5 million EUR | 1 percent |
SMEs read the table the other way round
For small and medium-sized companies, including start-ups, the fine is capped at the lower of the two amounts in each tier, not the higher. The duty is identical. Only the ceiling moves.
Where Article 4 lands, and why that is not a footnote
The literacy duty falls in the middle tier: up to 15 million EUR or 3 percent of worldwide turnover. Not the headline number, but attached to the widest obligation in the whole Act. Article 4 does not care whether your AI is high-risk. If your staff, or contractors acting on your behalf, use AI at work, the duty applies to you, and it has applied since 2 February 2025.
higher of 7% (€4m) or €35m fixed, so the fixed floor applies
higher of 3% (€2m) or €15m fixed, so the fixed floor applies
higher of 1% (€1m) or €7.5m fixed, so the fixed floor applies
Illustration of Article 99. The regulator picks the higher of a percentage and a fixed cap. Not legal advice.
There is a second cost channel that gets less attention. Literacy failures rarely stay contained in Article 4. An untrained overseer of a high-risk system is an Article 26 problem. An operator who could not spot a manipulated instruction is the root cause behind an incident an authority will read end to end. When something goes wrong, the training record is one of the first documents requested, and a gap there colours everything else in the file.
Maximums are not verdicts
Every figure above is a ceiling, not a tariff. Article 99 tells authorities to weigh the nature and duration of the breach, its consequences, the size of the company, cooperation, and, decisively for this topic, the measures already in place when the breach surfaced. Two companies with the same incident and different training records are not in the same meeting.
What an authority sees first
Not your intentions. Your records. Who was trained, on what content, when, at what depth per role, and whether any of it can be independently verified. An editable spreadsheet asserting completion proves little. Evidence that cannot be quietly rewritten proves a programme existed before the trouble did.
The enforcement calendar
The Act entered into force in August 2024 and switches on in stages. The part that matters for literacy: the duty has applied since 2 February 2025, the penalty framework has applied since 2 August 2025, and from 2 August 2026 the national supervision machinery is fully in place and running. From that point, the question is not whether the rule applies to you. It is what your file looks like when someone asks.
AI literacy applies
The Article 4 duty to take AI-literacy measures starts to apply.
Tap a point.
Waiting for the first published fine before acting is a strategy, but a poor one. The duty is already live, which means the period an authority can ask about is already accumulating. A programme started today still produces a better file than one started after the letter arrives, because the record shows initiative rather than reaction.
Making the middle tier irrelevant
- 1Map who touches AIStaff and anyone operating AI on your behalf, contractors included. This list is the scope of your duty.
- 2Train in proportion to roleA marketing assistant and an agent operator do not need identical measures. Article 4 names knowledge, experience, training, use context, and affected people as relevant factors.
- 3Prove behaviour, not attendanceA completion certificate says someone watched. A drill record says they caught the poisoned instruction. Authorities read the second differently.
- 4Keep evidence that cannot be rewrittenDates, content versions, per-person records, in a form you could hand over as-is. Tamper-evident beats editable.
Not legal advice
Temja is an educational tool, not a certification body, and this is not legal advice. The figures cited come from Article 99 of the Act. For your specific exposure, ask your counsel.
take these with you
- 01Article 99 fines reach 35 million EUR or 7 percent of worldwide turnover at the top tier.
- 02The Article 4 literacy duty sits in the middle tier: up to 15 million EUR or 3 percent.
- 03Fines are maximums shaped by severity, cooperation, and the measures you already had. Records decide that.
- 04The duty has applied since February 2025. National enforcement is fully live from August 2026.
Questions people ask
What is the maximum fine under the EU AI Act?
Up to 35 million EUR or 7 percent of worldwide annual turnover, whichever is higher. That top tier applies to prohibited practices under Article 5.
What can a breach of Article 4 AI literacy cost?
Article 4 falls in the middle tier of Article 99: up to 15 million EUR or 3 percent of worldwide turnover, whichever is higher. For SMEs the lower amount applies.
When does enforcement of the EU AI Act begin?
The literacy duty has applied since 2 February 2025 and the penalty framework since 2 August 2025. From 2 August 2026 national supervision and enforcement are fully in place.
Do training records really affect the fine?
Yes. Article 99 directs authorities to weigh the measures already in place, cooperation, severity, and duration. A documented, verifiable training programme is exactly such a measure.
from reading to reflex
See what trained behaviour looks like.
The drill takes about eight minutes. No sign-up, no card. Meet the poisoned invoice and find out if you reach STOP in time.
keep reading