Article 90: Alerts of systemic risks by the scientific panel
Article 90 empowers the scientific panel to provide a qualified alert to the AI Office where it has reason to suspect that a general-purpose AI model poses a concrete identifiable risk at Union level or meets the conditions for systemic risk classification under Article 51. Upon such alert, the Commission (through the AI Office) may exercise enforcement powers. The alert must be duly reasoned and include specific information.
Who does this apply to?
- -Member States establishing national penalty frameworks for AI Act infringements
- -National courts and administrative authorities responsible for imposing penalties on non-compliant operators
- -Providers and deployers subject to national penalty regimes and administrative fines for AI Act violations
Scenarios
France transposes the AI Act penalty framework into national law, creating a schedule of administrative fines that mirrors the tiered structure in Article 99. The French legislature adds a provision requiring authorities to consider a start-up's annual revenue and funding stage when calculating fines, ensuring a seed-stage company is not driven into insolvency by a first-time infringement.
A Member State delays implementing national penalty rules beyond the 2 August 2026 application date. A provider deploys a high-risk AI system without a conformity assessment, but the national authority has no penalty mechanism to enforce compliance.
What Article 90 does (in plain terms)
Article 90 does not establish the national penalty regime. That is Article 99. It creates a scientific alert channel into the AI Office.
1. Two grounds for an alert. Either (a) a GPAI model poses a concrete identifiable risk at Union level, or (b) a GPAI model meets the conditions in Article 51 for systemic risk. 2. What follows. After the alert the Commission, through the AI Office and having informed the Board, may exercise the powers in this Section to assess the matter. The AI Office informs the Board of any measures under Articles 91 to 94. 3. Minimum content. The alert must be duly reasoned and state at least the provider's contact point, the facts and reasons, and any other relevant information.
How Article 90 connects to the rest of the Act
- Article 51: the systemic-risk classification conditions referred to in paragraph 1(b).
- Article 68: the scientific panel of independent experts.
- Articles 91 to 94: documentation, evaluation, measures and procedural rights that may follow an alert.
- Article 101: the GPAI-specific fine regime.
- Article 113: dates of application.
Practical guidance
For GPAI providers: an alert from the scientific panel is not a fine, but it can open the powers in Articles 91 to 94. Keep the contact point and the systemic-risk documentation current.
Do not confuse this article with the Member State duty to provide for penalties (Article 99(1)) or with notification of the penalty regime to the Commission (Article 99(2)).
Official wording: Article 90
Article 90
Alerts of systemic risks by the scientific panel
1. The scientific panel may provide a qualified alert to the AI Office where it has reason to suspect that:
(a) a general-purpose AI model poses concrete identifiable risk at Union level; or
(b) a general-purpose AI model meets the conditions referred to in Article 51.
2. Upon such qualified alert, the Commission, through the AI Office and after having informed the Board, may exercise the powers laid down in this Section for the purpose of assessing the matter. The AI Office shall inform the Board of any measure according to Articles 91 to 94.
3. A qualified alert shall be duly reasoned and indicate at least:
(a) the point of contact of the provider of the general-purpose AI model with systemic risk concerned;
(b) a description of the relevant facts and the reasons for the alert by the scientific panel;
(c) any other information that the scientific panel considers to be relevant, including, where appropriate, information gathered on its own initiative.
Compliance checklist
- Monitor legislative developments in each Member State where you operate to track the transposition of AI Act penalty rules under Article 90.
- Map your AI system portfolio against applicable national penalty regimes, identifying which Member State's rules apply to each system.
- Assess whether your organisation qualifies as an SME or start-up under applicable definitions and document this for penalty mitigation purposes.
- Maintain comprehensive compliance documentation that demonstrates good-faith efforts, which may serve as a mitigating factor under national penalty rules.
- Budget for potential penalties using Article 99 ceilings as upper bounds while monitoring national implementations for actual fine levels.
- Establish a cross-jurisdictional penalty risk register that tracks both the likelihood and magnitude of enforcement action in each market.
Understand your penalty exposure across Member States, start the free assessment.
Start free assessmentRelated articles
Frequently asked questions
Does Article 90 set the actual fine amounts?
No. Article 90 requires Member States to create penalty rules but does not prescribe specific amounts. The ceiling amounts for administrative fines are set at EU level by Article 99 (up to EUR 35M/7% of global turnover for the most serious infringements). Member States must implement these ceilings in their national rules, but may also add additional penalty types such as periodic penalty payments or non-monetary sanctions.
How does the SME consideration work in practice?
Article 90 requires Member States to take into account the interests and economic viability of SMEs and start-ups when establishing penalty rules. In practice, this means national penalty frameworks should include mechanisms for scaling fines to an operator's size and financial capacity, for example, reduced fine ceilings for micro-enterprises, instalment payment options, or formal consideration of funding stage in the penalty calculation.
Can a provider face penalties in multiple Member States for the same AI system?
Potentially yes. If an AI system is placed on the market in multiple Member States and infringes the AI Act in each, the market surveillance authority in each Member State could take enforcement action under its national penalty rules. However, the principle of ne bis in idem (prohibition of double jeopardy) and the coordination mechanisms under Article 74 should prevent duplicative penalties for the same infringement.