The EU AI Act’s maximum penalties are up to €35m or 7% of global turnover for prohibited practices, and up to €15m or 3% for breaching the high-risk rules, but the Act explicitly requires proportionate caps for SMEs, and fines must reflect the size and circumstances of the business. For an Irish SME, the realistic exposure is not a headline-grabbing fine; it is enforcement attention, remediation costs and commercial damage from being demonstrably ungoverned.
The three penalty tiers
Article 99 of the AI Act structures fines by the seriousness of the breach:
- Prohibited practices , up to €35m or 7% of worldwide annual turnover, whichever is higher. Reserved for the Article 5 bans: social scoring, workplace emotion recognition, untargeted face scraping and the rest.
- Most other obligations , up to €15m or 3% for breaching the high-risk requirements and other operative duties, including the Article 50 transparency rules.
- Misleading information , a lower tier for supplying incorrect or incomplete information to authorities.
The SME proportionality rule
The figures above are ceilings, not tariffs. The Act requires authorities to weigh the nature and duration of the breach, its consequences, whether it was negligent or intentional, and the steps taken to fix it, and for SMEs and start-ups, it provides for proportionate caps tied to the lower of the percentage and fixed amounts, with regard to the firm’s economic viability. None of which is a licence to relax: it means a small firm that engaged honestly and can show its working faces a very different conversation from one that cannot produce a single record.
When penalties become enforceable in Ireland
Application dates vary by provision. Article 50 generally applies from 2 August 2026. The main Annex III high-risk rules apply from 2 December 2027, and the corresponding Annex I rules from 2 August 2028, under the enacted amendment. A penalty assessment must identify the actual breached provision, responsible actor and any transition; it cannot be inferred from the headline maximum alone.
The risks that arrive before any fine
For most Irish SMEs the first cost of non-compliance will be commercial, not regulatory:
- Enterprise customers adding AI governance questions to procurement , an unanswered questionnaire loses the deal long before a regulator calls.
- Insurers and funders asking for evidence of AI governance at renewal and diligence.
- Employment claims: an unmanaged CV-screening tool creates discrimination exposure under existing Irish employment law in parallel with the AI Act.
- Remediation under pressure, unwinding an undocumented system to an enforcement timetable costs far more than registering it ever would.
The cheapest defence is a current register
Every factor a regulator must weigh, engagement, remediation, records , is evidenced by the same thing: a maintained AI register with classifications, obligations and dated decisions. That is what AI Register Ireland provides, at a cost a long way short of any tier of Article 99. See pricing.
Legal references checked 4 October 2026: AI Omnibus in force; Article 4 guidance; Current application dates; Article 50 transparency; High-risk classification; Irish Act and AI Office. Check the provision and any transition that applies to your particular system.