Penalties for breaching the EU AI Act's disclosure rules
The AI Act sorts its penalties into tiers, and the transparency duties for synthetic content sit in the middle one.
Which tier Article 50 breaches fall into
The AI Act sorts infringements into bands, and the transparency duties for synthetic content are not in the most severe one. Article 99(4) sets administrative fines of up to EUR 15,000,000 or, if the offender is an undertaking, up to 3 percent of its total worldwide annual turnover for the preceding financial year, whichever is higher [1]. Subparagraph (g) of that list is "transparency obligations for providers and deployers pursuant to Article 50" [1].
For comparison, Article 99(3) reserves the top band for the prohibited practices in Article 5, at up to EUR 35,000,000 or 7 percent of worldwide annual turnover [1]. Article 99(5) sets a lower band, up to EUR 7,500,000 or 1 percent, for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request [1].
The SME rule inverts the calculation
One provision is easy to miss and reverses the arithmetic for smaller organisations. Article 99(6) states that in the case of SMEs, including start-ups, each fine shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower [1].
So the general rule takes the higher of the fixed sum and the turnover percentage, and the SME rule takes the lower. For a small company, 3 percent of turnover will usually be far below EUR 15,000,000, and that smaller figure becomes the ceiling rather than the floor.
Which authorities impose Article 50 fines: Member States, not one EU regulator
Enforcement is national. Member States shall lay down rules on penalties applicable to infringements of the Regulation by operators, and shall take all measures necessary to ensure that they are properly and effectively implemented [1]. Member States also designate or establish one or more national competent authorities to ensure implementation and enforcement [1].
The practical consequence is that there is no single European regulator for these duties. A publisher or platform operating across the Union deals with the authorities of the Member States it operates in, and the AI Act builds in a coordination step: where no objection has been raised within three months of notification, by a market surveillance authority of another Member State or by the Commission, a provisional measure taken by one Member State's authority is deemed justified [1].
Union institutions are treated separately, and far more lightly
Fines against EU institutions, bodies, offices and agencies run on a different scale and through a different body. The European Data Protection Supervisor may impose them, with non-compliance with the Article 5 prohibitions attracting up to EUR 1,500,000 and non-compliance with other provisions up to EUR 750,000 [1].
How the size of an AI Act fine is decided
The Regulation directs that, when assessing the amount, all relevant circumstances of the specific situation be taken into account, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences, and to the size of the provider, in particular where the provider is an SME including a start-up [1]. The ceiling is therefore a ceiling and not an expected outcome.
The penalty regime started before the obligation it penalises
The sequencing is unusual enough to be worth stating plainly. Article 113 provides that the Regulation applies from 2 August 2026, with exceptions, and one of those exceptions is that Chapter XII, which contains the penalty provisions, applies from 2 August 2025, with the exception of Article 101 [1].
The machinery for penalties has therefore been in force for roughly a year longer than the Article 50 transparency duties it can be applied to. Nothing follows from that about liability for conduct before 2 August 2026; it simply means the enforcement structure was standing and waiting when the obligations began.
What is not yet known about Article 50 penalties in practice
No enforcement precedent under Article 50 was found in the Regulation or in publicly available records at the time of writing, which is unsurprising given how recently the obligations began to apply. That means the practical questions, how strictly authorities read "machine-readable format", what disclosure they will accept as "clear and distinguishable", and how the artistic and satirical carve-out is applied, do not yet have answers from any decided case.
This page describes what the instrument says. It is educational material and not legal advice, and anyone with a live compliance question should take advice in the relevant jurisdiction. Our companion page on what Article 50 requires sets out the obligations themselves.
- Synthetic media disclosure obligations now in force , what Article 50 actually requires, which these penalties enforce
- What the C2PA conformance registry actually lists , the marking infrastructure that exists today
Sources
- [1]European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 50, 99, 100 and 113, official consolidated text.
Common questions on this topic
What is the fine for breaching Article 50 of the EU AI Act?
Article 99(4) sets administrative fines of up to EUR 15,000,000 or, if the offender is an undertaking, up to 3 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. Subparagraph (g) of that list covers transparency obligations for providers and deployers pursuant to Article 50.
Are the penalties lower for small companies?
Article 99(6) provides that for SMEs, including start-ups, each fine shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower. The general rule takes the higher of the fixed sum and the turnover percentage; the SME rule inverts that and takes the lower.
Who enforces the EU AI Act transparency rules?
Member States. They lay down the rules on penalties and designate one or more national competent authorities to ensure implementation and enforcement. There is no single European regulator for these duties, though the Regulation provides that a provisional measure taken by one Member State's authority is deemed justified where no objection is raised within three months.