The EU AI Act’s maximum penalties are up to €35m or 7% of global turnover for prohibited practices, and up to €15m or 3% for breaching the high-risk rules — but the Act explicitly requires proportionate caps for SMEs, and fines must reflect the size and circumstances of the business. For an Irish SME, the realistic exposure is not a headline-grabbing fine; it is enforcement attention, remediation costs and commercial damage from being demonstrably ungoverned.
The three penalty tiers
Article 99 of the AI Act structures fines by the seriousness of the breach:
- Prohibited practices — up to €35m or 7% of worldwide annual turnover, whichever is higher. Reserved for the Article 5 bans: social scoring, workplace emotion recognition, untargeted face scraping and the rest.
- Most other obligations — up to €15m or 3% for breaching the high-risk requirements and other operative duties, including the Article 50 transparency rules.
- Misleading information — a lower tier for supplying incorrect or incomplete information to authorities.
The SME proportionality rule
The figures above are ceilings, not tariffs. The Act requires authorities to weigh the nature and duration of the breach, its consequences, whether it was negligent or intentional, and the steps taken to fix it — and for SMEs and start-ups, it provides for proportionate caps tied to the lower of the percentage and fixed amounts, with regard to the firm’s economic viability. None of which is a licence to relax: it means a small firm that engaged honestly and can show its working faces a very different conversation from one that cannot produce a single record.
When penalties become enforceable in Ireland
Exposure follows the Act’s staggered deadlines. The Article 5 prohibitions have been enforceable since 2 February 2025. Article 50 chatbot disclosure attaches from 2 August 2026, content labelling from 2 December 2026, and the Annex III high-risk duties from 2 December 2027 under the May 2026 Omnibus agreement — subject to formal adoption, with 2 August 2026 as the fallback if it is not adopted in time (see the Omnibus deferral, explained). On the Irish side, the Regulation of AI Bill 2026 is building the national enforcement machinery, with the AI Office of Ireland being stood up as the coordinating authority.
The risks that arrive before any fine
For most Irish SMEs the first cost of non-compliance will be commercial, not regulatory:
- Enterprise customers adding AI governance questions to procurement — an unanswered questionnaire loses the deal long before a regulator calls.
- Insurers and funders asking for evidence of AI governance at renewal and diligence.
- Employment claims: an unmanaged CV-screening tool creates discrimination exposure under existing Irish employment law in parallel with the AI Act.
- Remediation under pressure — unwinding an undocumented system to an enforcement timetable costs far more than registering it ever would.
The cheapest defence is a current register
Every factor a regulator must weigh — engagement, remediation, records — is evidenced by the same thing: a maintained AI register with classifications, obligations and dated decisions. That is what AI Register Ireland provides, at a cost a long way short of any tier of Article 99. See pricing.