EU AI Act: Businesses risk heavy fines

5 min read

Businesses must comply with prohibitions that already apply when using artificial intelligence. The EU AI Act provides for fines of up to 35 million euros or 7 per cent of worldwide annual turnover for breaches of these prohibitions. For small and medium-sized enterprises, the lower amount applies. The main rules for high-risk systems will follow later – from December 2027 or August 2028, depending on the system. As at 3 November 2026.

Which AI practices are already prohibited

The AI Act prohibits certain applications because of the risks they pose to people. The first prohibitions have applied since 2 February 2025. These include social scoring, where people are evaluated based on their social behaviour or personal characteristics and this leads to unjustified or disproportionate detrimental treatment in the contexts described in the Act. The prohibition is not limited to public authorities.

Systems used to infer emotions in the workplace are also generally prohibited. The regulation makes an exception for applications placed on the market or put into service for medical or safety reasons. Whether a particular product falls within the prohibition depends on its function and intended purpose. No blanket conclusion can be drawn for all recruitment or call centre products.

Other prohibitions concern certain manipulative or deceptive techniques and the exploitation of vulnerabilities. The conditions set out in Article 5 determine whether each prohibition applies. The article also contains specific rules and exceptions for biometric applications.

When the rules for high-risk systems take effect

The regulation distinguishes between several groups of high-risk systems. Annex III lists certain areas of use, including some applications in candidate selection and employment. However, use in human resources alone does not automatically make every AI application a high-risk system. The precise intended purpose and the legal conditions determine its classification.

For high-risk systems under Article 6(2) and Annex III, the main requirements generally apply from 2 December 2027. For high-risk systems under Article 6(1) and Annex I that relate to certain regulated products, the date is generally 2 August 2028. The Council of the EU confirms this phased approach. The relevant transitional provisions must be assessed separately for systems already placed on the market.

How providers and deployers should prepare

What is a deployer? The AI Act generally uses this term for a person or organisation that uses an AI system under its own authority. Purely personal, non-professional use is excluded. Providers develop a system or have it developed and place it on the market or put it into service under their own name or trademark.

The regulation assigns different responsibilities for high-risk systems. Providers must meet requirements relating to risk management, technical documentation and conformity assessment, among other things. Subject to the relevant legal conditions, deployers must, for example, ensure human oversight and monitor use in accordance with the instructions for use. The conformity assessment required depends on the system. There is no blanket requirement for external certification of all high-risk systems.

A useful first step is to take stock: Which AI functions are being used? What are they intended for? Who provides them and who decides how they are used? For potential high-risk applications, businesses should examine the classification and the provider’s documentation. Certain changes to a system or its intended purpose can change a party’s role.

Regardless of the later high-risk deadlines, the obligation to take measures to ensure a sufficient level of AI literacy among people who deal with AI systems on behalf of the business already applies. Appropriate measures depend on factors including their knowledge and the context of use.

What fines businesses could face

For breaches of the prohibitions under Article 5, the AI Act provides for fines of up to 35 million euros or up to 7 per cent of worldwide annual turnover for the preceding financial year. For undertakings, the higher amount generally applies. For small and medium-sized enterprises, including start-ups, the lower of the two maximum amounts applies.

Other breaches fall under different penalty ranges. The circumstances of each case must be considered when deciding on a fine. The statutory maximum therefore does not determine the penalty for an individual business.

Frequently asked questions

Image source: AI-generated (November 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.