Article 99's fine ladder is already live for financial institutions

Article 99’s fine ladder is already live for financial institutions: prohibited AI practices under Article 5 can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher.

Most other operator duties sit one rung down — including deployer obligations under Article 26 and transparency under Article 50 — at up to €15 million or 3% (Article 99(4)). Feeding incorrect, incomplete, or misleading information to a competent authority tops out at €7.5 million or 1%. The Digital Omnibus (Regulation (EU) 2026/1744) deferred some high-risk deadlines but did not cut these ceilings; it mainly extended the SME-style “lower of” fine calculation to small mid-caps. GPAI model providers face a separate Commission regime under Article 101 (same 15M / 3% shape).

If AI Act risk is still framed as “December 2027 high-risk homework,” recalibrate: Chapter XII penalties have applied since 2 August 2025, so prohibited-practice and transparency exposure are already enforceable.