Not yet, as far as the public record shows. As at 25 September 2026, we have found no fine under the EU AI Act announced by the European Commission or by any national regulator. That does not make the Act a paper tiger. The penalty rules are in force, regulators have powers, anyone can complain, and the first pressure on most businesses is coming from customers, not regulators.
Boards are asking the question for a sensible reason: if nobody has been fined, why spend money now? This article sets out what the enforcement position actually is, why the absence of fines is the wrong signal to act on, and where the real pressure is building.
Has anyone been fined under the EU AI Act?
We have found no fine under the EU AI Act announced by a regulator. Some websites report large AI Act fines, sometimes with precise figures. When we checked those reports, none named the regulator, the company or the decision. Treat any report of an AI Act fine as unconfirmed until you can find the regulator’s own announcement.
AI is already being fined under other laws. Data protection regulators have taken action against AI systems that processed personal data unlawfully, under the GDPR. The AI Act adds to that exposure. It does not replace it.
What regulators can already do
The enforcement machinery is in place, even if it has not yet produced a published fine:
- The penalty rules apply. The penalty provisions have applied since August 2025, when member states were required to appoint their regulators and set their penalty rules.
- The fines are large. Up to EUR 35 million or 7% of global annual turnover for banned practices, and up to EUR 15 million or 3% for most other breaches, whichever is higher. For small and medium-sized businesses, the lower figure applies.
- The Commission can fine AI model providers. Its power to fine providers of general-purpose AI models has applied since August 2026.
- Anyone can complain. Any person or business with grounds to believe the Act has been broken can complain to a market surveillance authority, which can then investigate.
The last point matters most for boards. Enforcement does not depend on a regulator finding you. An employee, a rejected job applicant, a customer or a competitor can start it.
Why there have been no fines yet
Three reasons, none of them reassuring for long.
- The biggest obligations have not started. The rules for high-risk AI, the ones most businesses will be judged on, apply from 2 December 2027, or 2 August 2028 for AI built into regulated products. What applies today is narrower: the banned practices, AI literacy, the rules for general-purpose AI models and the Article 50 transparency duties.
- Regulators start with guidance. New regimes usually begin with guidance, questions and investigations before penalties. Investigations take months, and fines follow investigations.
- Regulators are still building up. National authorities are appointing staff, agreeing how they work together and deciding their priorities.
None of this changes what the Act requires. It changes only how soon a regulator is likely to ask. The board that waits for the first published fine will be starting its inventory when others are already showing their evidence.
Are customers asking?
This is where the pressure is arriving first. The Act is built so that evidence flows through the supply chain. A business that uses high-risk AI has to operate it in line with the provider’s instructions, keep its logs, assign human oversight and, in some cases, assess its impact on people’s rights. It cannot do any of that without documentation from the business that supplied the system. So buyers ask their suppliers, and those suppliers ask theirs.
The public sector has already written this into contracts. EU model contractual clauses for buying AI, updated in March 2025 to match the Act, set out what public buyers can require of AI suppliers: risk management, data governance, transparency, human oversight, accuracy and cybersecurity. They are voluntary, but they show the questions an informed buyer will ask.
Expect questions like these in tenders, security questionnaires and contract renewals:
- Where do you use AI in the service you provide to us?
- Is any of it high-risk under the EU AI Act, and what is your role for it?
- Who is accountable for it, and what human oversight is in place?
- What documentation and evidence can you share, and will you notify us of changes and incidents?
A business that can answer quickly, with evidence, shortens the sales cycle. One that cannot gives the buyer a reason to pause, or to choose a competitor who can. For many companies, that is the first real cost of the Act, and it arrives long before any fine.
What the board should do now
- Stop waiting for the first fine. Plan against the dates in the Act, not the headlines.
- Build the evidence once. The inventory, roles, risk categories and controls that a regulator would ask for are the same evidence customers are asking for. The steps are set out in What Is the EU AI Act? A Plain-English Guide for Boards.
- Prepare the customer answer. Draft a short, accurate statement of where you use AI, what role you play and how it is governed, ready for tenders and questionnaires.
- Check what already applies. Confirm nothing falls under the banned practices, and that people are told when they deal with AI. Those rules are live now. The EU AI Act deadline briefing sets out what applies and when.
- Watch for the first case. When the first fine is published, read the regulator’s decision, not the coverage. It will show where regulators are looking first.
The EU AI Act Board Checklist below takes a board through these points in about 15 minutes. For the evidence itself, the AIPEX EU AI Act Readiness Assessment builds the AI inventory, maps your role and risk category for each system, and gives the board a prioritised action plan. The same evidence answers the regulator and the customer.
Frequently asked questions
Has anyone been fined under the EU AI Act?
As at 25 September 2026, we have found no fine under the EU AI Act announced by the European Commission or a national regulator. Reports of large AI Act fines that name no regulator, company or decision should be treated as unconfirmed. For a full explanation, see Has Anyone Been Fined Under the EU AI Act? →
What are the maximum fines under the EU AI Act?
Up to EUR 35 million or 7% of global annual turnover for banned practices, and up to EUR 15 million or 3% for most other breaches, whichever is higher. For small and medium-sized businesses, the lower figure applies.
Why are customers asking suppliers about the EU AI Act?
Businesses that use high-risk AI need documentation from their suppliers to meet their own duties, so they ask for it in tenders, questionnaires and renewals. EU model contractual clauses for buying AI set out the same questions for public buyers. For the evidence boards need, see What Is the EU AI Act? A Plain-English Guide for Boards →
Correct as of 25 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 25 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.