EU AI Act

EU AI Act: every application date and every fine tier, from the Regulation itself

The EU AI Act does not take effect on one date, and it does not fine on one scale. Article 113 staggers application across four dates from 2 February 2025 to 2 August 2027, and Article 99 sets three fine tiers with ceilings from EUR 7,500,000 to EUR 35,000,000. This guide gives you both, straight from the Regulation, plus the SME rule in Article 99(6) that reverses the usual cap and the separate Commission fining power in Article 101.

Every application date: Article 113

Article 113 sets a default application date and then carves out three exceptions. The Regulation entered into force on the 20th day after its publication in the Official Journal, which is dated 12 July 2024. Entry into force is not the same as application. The obligations bite on the dates below.

Date What applies Provision
2 February 2025 Chapters I and II Article 113(a)
2 August 2025 Chapter III Section 4, Chapter V, Chapter VII, Chapter XII and Article 78, with the exception of Article 101 Article 113(b)
2 August 2026 The Regulation as a whole, the general application date Article 113, second paragraph
2 August 2027 Article 6(1) and the corresponding obligations in the Regulation Article 113(c)

Two carve-outs inside the carve-outs deserve attention, because they are easy to miss.

First, Article 113(b) pulls Chapter XII forward to 2 August 2025 but excepts Article 101. Article 101 is the Commission's power to fine providers of general-purpose AI models. It sits in a chapter that otherwise applies early, but the exception means it falls back to the general date of 2 August 2026.

Second, Article 113(c) pushes Article 6(1) and "the corresponding obligations" back to 2 August 2027, a full year after the general date. If you are tracking deadlines for a compliance program, that phrase matters: it is not Article 6(1) alone that waits, but the obligations that correspond to it.

The closing formula of Article 113 is also worth having verbatim, because it states the legal character of the instrument:

This Regulation shall be binding in its entirety and directly applicable in all Member States.

It is a regulation, not a directive. It does not wait for national transposition to apply.

Every fine tier: Article 99

Article 99 puts enforcement in the hands of Member States. Under Article 99(1), Member States "shall lay down the rules on penalties and other enforcement measures," which may include warnings and non-monetary measures, and the penalties "shall be effective, proportionate and dissuasive." Under Article 99(2), Member States must notify the Commission of their penalty rules by the date of entry into application at the latest.

The Regulation then fixes three ceilings for administrative fines.

Tier Infringement Ceiling
Article 99(3) Non-compliance with the prohibition of the AI practices referred to in Article 5 Up to EUR 35,000,000 or, for an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher
Article 99(4) Non-compliance with listed operator and notified body obligations, other than Article 5 Up to EUR 15,000,000 or, for an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher
Article 99(5) Supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request Up to EUR 7,500,000 or, for an undertaking, up to 1% of total worldwide annual turnover for the preceding financial year, whichever is higher

The middle tier is not vague. Article 99(4) lists exactly which provisions it covers: provider obligations under Article 16, authorized representative obligations under Article 22, importer obligations under Article 23, distributor obligations under Article 24, deployer obligations under Article 26, notified body requirements under Article 31, Article 33(1), (3) and (4) or Article 34, and the transparency obligations for providers and deployers under Article 50. If a fine question turns on which tier applies, it turns on whether the obligation sits in that list or in Article 5.

Article 99(7) then lists the circumstances that shape the amount in an individual case. They include the nature, gravity and duration of the infringement, whether fines have already been applied by other authorities for the same conduct, the operator's size, turnover and market share, the degree of cooperation with national competent authorities, how the infringement became known, whether the conduct was intentional or negligent, and mitigating action taken for affected persons.

The SME reversal in Article 99(6)

Every ceiling in Article 99 is expressed as a fixed sum or a turnover percentage, "whichever is higher." For small and medium-sized enterprises, Article 99(6) flips that:

In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.

For a large undertaking, the cap is whichever figure is bigger. For an SME, the cap is whichever is smaller. Take a hypothetical start-up with a turnover of EUR 10,000,000 that breaches the Article 5 prohibitions. Its 7% figure is EUR 700,000, which is lower than EUR 35,000,000, so EUR 700,000 is its ceiling. The same breach by a large undertaking is capped at the higher of the two figures. This is consistent with Article 99(1), which requires penalties to take into account "the interests of SMEs, including start-ups, and their economic viability."

Article 101 is a different power

Do not fold Article 101 into the Article 99 scheme. Article 99 fines are imposed under national rules laid down by Member States. Article 101 fines are imposed by the Commission itself, and only on providers of general-purpose AI models.

The ceiling under Article 101(1) is 3% of annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher. The Commission may impose it when it finds the provider intentionally or negligently did one of four things: infringed the relevant provisions of the Regulation, failed to comply with a request for a document or information under Article 91 or supplied incorrect, incomplete or misleading information, failed to comply with a measure requested under Article 93, or failed to give the Commission access to the model for an evaluation under Article 92.

The procedure is also distinct. Under Article 101(2), the Commission must communicate its preliminary findings to the provider and give it an opportunity to be heard before deciding. Under Article 101(5), the Court of Justice of the European Union has unlimited jurisdiction to review Commission fining decisions and may cancel, reduce or increase the fine. Note one drafting point that catches people out: the SME reversal in Article 99(6) refers to "each fine referred to in this Article," meaning Article 99. Article 101 states its own ceiling as "whichever is higher" and contains no equivalent reversal.

Where this sits in the AIGP

If you are preparing for the IAPP's AIGP exam, this material falls under Domain II, "Understanding how laws, standards and frameworks apply to AI," and specifically competency II.C, "Understand the main elements of AI-specific laws," which the version 2.1 blueprint allocates 6 to 8 items. The blueprint was approved on 9 September 2025 and takes effect on 2 February 2026. The exam itself is 3 hours and 100 items, all multiple choice, each worth one point, with no essays. Credential Press is independent of the IAPP; this guide is our reading of the Regulation, not an official study resource.

What you need to be able to do is keep the machinery straight: which date applies to which chapter, which fine tier attaches to which obligation, which body imposes the fine, and how the SME rule inverts the cap. Learn the four dates in Article 113 as a set, learn the three ceilings in Article 99 with their percentages, and keep Article 101 in its own box as a Commission power over general-purpose model providers. If you can state each of those in the Regulation's own terms, you have this corner of the syllabus where it needs to be.

Sources

Every figure, date and quotation above was read from the document itself on 5 August 2026, not from a summary of it.

Credential Press is not affiliated with, endorsed by or authorized by the IAPP or any other certification body. Exam names and trademarks belong to their owners.

We are writing the book on this. The AIGP Exam Guide covers all 4 domains and all 13 competencies, in proportion to the published item weights. Join the first-reader list and you get it free before it goes on sale.