EU AI Act Prohibited Practices: €35 Million Fines for Banned AI Systems

Regulatory Authority: Regulation (EU) 2024/1689, Article 5 (Prohibited AI practices), Article 99(3) (Administrative fines for prohibited practices), Article 99(6) (SME/startup considerations), Recital 44 (emotion recognition exceptions), Recital 45 (social scoring), Article 83 (Market surveillance), Article 74 (National competent authority designation)

Applies to any provider or deployer who places on the market, puts into service, or uses any AI system falling within the eight prohibited practice categories defined in Article 5. The penalty is calculated based on global worldwide turnover — not just EU revenue — making it exceptionally punitive for multinational companies.

Article 99(6) requires national competent authorities to take into account the size and economic resources of the operator when imposing penalties on SMEs and startups. In practice, this means fines for smaller companies may be significantly lower than the headline maximum — but the 7%-of-turnover structure still applies as a ceiling reference.

Understand Your EU AI Act Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

Take the Quiz →   Gap Analyzer →

What are the eight AI systems prohibited under Article 5 of the EU AI Act?

Article 5 of Regulation (EU) 2024/1689 prohibits: (1) AI systems that use subliminal techniques beyond a person's consciousness to distort behavior in a way that causes harm; (2) AI systems that exploit vulnerabilities of specific groups (age, disability, social or economic situation) to distort behavior harmfully; (3) social scoring systems by public authorities that classify people based on behavior, personal characteristics, or social behavior and cause detrimental or unfavorable treatment; (4) real-time remote biometric identification systems in publicly accessible spaces for law enforcement, with narrow exceptions (Article 5(1)(h)); (5) AI systems used to infer emotions of individuals in workplaces and educational institutions, except for safety reasons; (6) biometric categorization systems that classify individuals based on sensitive attributes (race, political opinion, religion, philosophical belief, sexual orientation, nationality); (7) AI systems that create or expand facial recognition databases through untargeted scraping; and (8) AI systems used by law enforcement to make individual risk assessments for predicting criminal offenses solely based on profiling. The prohibition on most of these became applicable February 2, 2025.

How does the EU AI Act's 7% global turnover penalty compare to GDPR fines?

The EU AI Act's prohibited practice penalty (€35M or 7% of global turnover, whichever is higher) is structurally more severe than GDPR's maximum (€20M or 4% of global annual turnover). The AI Act's Tier 1 prohibited practices floor (€35M) is also higher than GDPR's Tier 2 maximum (€20M). However, both use global consolidated turnover as the base — the methodology EU regulators have applied in practice, meaning parent company revenue counts even when only a subsidiary is directly at fault. For large multinationals, the effective penalty exposure under Article 5 could exceed €1 billion. The key practical difference: GDPR has been enforced since 2018 with €4.5B+ in cumulative fines; AI Act enforcement infrastructure is still maturing, meaning first-mover violations are likely to face the most scrutiny.

Can a company appeal an EU AI Act fine imposed by a national competent authority?

Yes. Article 99 and Article 101 of the Regulation provide that operators can challenge NCA decisions through the national courts of the member state where the NCA is located. The appeal pathway mirrors GDPR enforcement: the NCA issues a decision, the operator can file an administrative appeal within the NCA (where available), then escalate to national court. The EU AI Office — which has oversight authority over general-purpose AI models and coordination over national NCAs — does not have direct adjudication authority over prohibited practice cases for most AI systems (those fall to national NCAs). For general-purpose AI models with systemic risk, the European Commission retains direct enforcement authority under Article 101(4). Courts can suspend the fine pending appeal, but the operator must typically demonstrate irreparable harm to obtain an interim suspension.