Up to €35 million: what AI Act non-compliance can cost you

The AI Act sets three scales. Prohibited AI practices, such as social scoring, manipulative techniques or untargeted facial recognition based on internet scraping, can lead to a fine of up to €35 million or 7% of worldwide annual turnover, whichever of the two is higher. Other obligations of providers and deployers of high-risk systems, such as missing technical documentation or insufficient human oversight, can cost up to €15 million or 3%. And supplying incorrect, incomplete or misleading information to a supervisory authority can cost up to €7.5 million or 1%.

SMEs and start-ups face an important nuance: where large companies face the higher of the two amounts, they always face the lower one. That softens the worst-case scenario, but when setting the final fine the supervisory authority also weighs how long the breach lasted, whether anything went wrong before, and how cooperatively a company works towards remediation. A well-documented overview of your AI systems counts as a mitigating circumstance. Missing one does the opposite.

In practice, a fine is rarely the first bill to arrive. More often it starts smaller: a tender you miss because you cannot produce an AI risk assessment within the deadline, or a lawyer who spends weeks on detective work that an AI Compliance Scan could have done in 30 minutes. Both cost money, but they never appear as a fine on an invoice. They appear as revenue you fail to win.

Reputational damage is part of it too, and that is hard to capture in an amount. A client who hears that you have no visibility into your own AI use will ask the same question about your next service or product. For an SMB that runs on repeat business and word of mouth, that loss of trust often weighs heavier than the highest figure in the AI Act.

Picture this: an IT service provider with 40 employees is bidding for a contract with a municipality. The specifications include a standard question: "describe which AI systems are used in delivering the service and how their risks are controlled." Because nobody in the company has a current overview, the marketing department uses a text generator, the helpdesk a chatbot plug-in, and nobody knows exactly which, answering that single question takes three working days of internal detective work. The submission deadline passes. That is not a fine, but it is a lost assignment that can outweigh a fine in size.

Compare the scale: an AI Compliance Scan takes 30 minutes and immediately gives you an overview you can show to a client, a contracting authority or a supervisory authority. A reactive trajectory, once a supervisory authority has come knocking or a tender has already been lost, can take weeks to months, often with external legal support. The costs of preparation are predictable and low. The costs of falling behind are neither.