Legalithm logo
Chapter XII — PenaltiesArticle 90

Article 90: Penalties

Applies from 2 Aug 20268 min readEUR-Lex verified Apr 2026

Article 90 empowers the scientific panel to provide a qualified alert to the AI Office where it has reason to suspect that a general-purpose AI model poses a concrete identifiable risk at Union level or meets the conditions for systemic risk classification under Article 51. Upon such alert, the Commission (through the AI Office) may exercise enforcement powers. The alert must be duly reasoned and include specific information.

Start free assessmentAll articles

Who does this apply to?

  • -Member States establishing national penalty frameworks for AI Act infringements
  • -National courts and administrative authorities responsible for imposing penalties on non-compliant operators
  • -Providers and deployers subject to national penalty regimes and administrative fines for AI Act violations

Scenarios

France transposes the AI Act penalty framework into national law, creating a schedule of administrative fines that mirrors the tiered structure in Article 99. The French legislature adds a provision requiring authorities to consider a start-up's annual revenue and funding stage when calculating fines, ensuring a seed-stage company is not driven into insolvency by a first-time infringement.

The French penalty rules satisfy Article 90's requirements: they are effective (capable of deterring non-compliance), proportionate (scaled to the operator's size and economic viability), and dissuasive (set at levels that discourage future infringements). The SME/start-up consideration satisfies Article 90's express requirement to account for economic viability.
Ref. Art. 90(1)–(3)

A Member State delays implementing national penalty rules beyond the 2 August 2026 application date. A provider deploys a high-risk AI system without a conformity assessment, but the national authority has no penalty mechanism to enforce compliance.

The Member State is in breach of its obligation under Article 90 to have penalty rules in place. The Commission may initiate infringement proceedings. Meanwhile, the AI Act's directly applicable provisions still bind the provider, but enforcement is hampered by the absence of a national penalty framework.
Ref. Art. 90(2)

What Article 90 does (in plain terms)

Article 90 is the delegation clause that requires Member States to create national penalty regimes for AI Act infringements. Its core elements:

1. Mandatory rules: Member States are not given discretion on whether to create penalties — they must lay down rules on penalties, including administrative fines, applicable to infringements of the AI Act. 2. Effectiveness trilogy: Penalties must meet the standard EU enforcement formula: they must be effective (capable of achieving compliance), proportionate (not excessive relative to the infringement), and dissuasive (sufficient to deter future non-compliance). 3. Commission notification: Member States must notify the Commission of their penalty rules by the applicable date and of any subsequent amendments without delay. This allows the Commission to monitor consistency and adequacy across the internal market. 4. SME and start-up sensitivity: Article 90 expressly requires Member States to take into account the interests of SMEs and start-ups, including their economic viability, when laying down penalty rules. This reflects the AI Act's broader concern with not stifling innovation. 5. Implementation obligation: Member States must take all measures necessary to ensure penalties are properly and effectively implemented — meaning not just enacted on paper but operationally enforced.

How Article 90 connects to the rest of the Act

  • Article 99 — Administrative fines: Article 99 sets the EU-level ceiling for fines (up to EUR 35M/7% for prohibited practices, EUR 15M/3% for high-risk obligations, EUR 7.5M/1% for incorrect information). Article 90 requires Member States to transpose these into national law.
  • Article 98 — Fines for Union institutions: the parallel penalty regime for EU institutions administered by the EDPS, complementing the national regime under Article 90.
  • Article 100 — Fines for providers of GPAI models: Commission-level fines for general-purpose AI model non-compliance, operating alongside national penalties under Article 90.
  • Article 113 — Application dates: Article 90 applies from 2 August 2026.

Practical guidance: navigating national penalty divergence

Because Article 90 delegates penalty design to Member States, operators should expect divergence in how fines are structured, calculated, and enforced across the EU:

1. Monitor national transpositions — Track legislative developments in every Member State where your AI systems are placed on the market. Penalty rules may differ significantly in structure (fixed fines vs. revenue-based), severity, and procedural safeguards. 2. Map your exposure — For each AI system, identify which Member State's penalty regime applies based on where the system is placed on the market or put into service. Multiple penalty regimes may apply simultaneously. 3. Leverage the SME carve-out — If you qualify as an SME or start-up, ensure your national penalty regime reflects the Article 90 requirement to consider economic viability. Challenge disproportionate fines on this basis. 4. Prepare mitigation evidence — When facing potential penalties, document all steps taken to ensure compliance, as national authorities will likely consider good-faith compliance efforts as mitigating factors. 5. Budget for worst-case scenarios — Use the Article 99 ceiling amounts as an upper bound for financial risk modelling, while recognising that national rules may set lower maximums.

Official wording: Article 90

Article 90

Alerts of systemic risks by the scientific panel

1. The scientific panel may provide a qualified alert to the AI Office where it has reason to suspect that:

(a) a general-purpose AI model poses concrete identifiable risk at Union level; or

(b) a general-purpose AI model meets the conditions referred to in Article 51.

2. Upon such qualified alert, the Commission, through the AI Office and after having informed the Board, may exercise the powers laid down in this Section for the purpose of assessing the matter. The AI Office shall inform the Board of any measure according to Articles 91 to 94.

3. A qualified alert shall be duly reasoned and indicate at least:

(a) the point of contact of the provider of the general-purpose AI model with systemic risk concerned;

(b) a description of the relevant facts and the reasons for the alert by the scientific panel;

(c) any other information that the scientific panel considers to be relevant, including, where appropriate, information gathered on its own initiative.

Compliance checklist

  • Monitor legislative developments in each Member State where you operate to track the transposition of AI Act penalty rules under Article 90.
  • Map your AI system portfolio against applicable national penalty regimes, identifying which Member State's rules apply to each system.
  • Assess whether your organisation qualifies as an SME or start-up under applicable definitions and document this for penalty mitigation purposes.
  • Maintain comprehensive compliance documentation that demonstrates good-faith efforts, which may serve as a mitigating factor under national penalty rules.
  • Budget for potential penalties using Article 99 ceilings as upper bounds while monitoring national implementations for actual fine levels.
  • Establish a cross-jurisdictional penalty risk register that tracks both the likelihood and magnitude of enforcement action in each market.
Read the official text on EUR-Lex

Understand your penalty exposure across Member States — start the free assessment.

Start Free Assessment

Frequently asked questions

Does Article 90 set the actual fine amounts?

No. Article 90 requires Member States to create penalty rules but does not prescribe specific amounts. The ceiling amounts for administrative fines are set at EU level by Article 99 (up to EUR 35M/7% of global turnover for the most serious infringements). Member States must implement these ceilings in their national rules, but may also add additional penalty types such as periodic penalty payments or non-monetary sanctions.

How does the SME consideration work in practice?

Article 90 requires Member States to take into account the interests and economic viability of SMEs and start-ups when establishing penalty rules. In practice, this means national penalty frameworks should include mechanisms for scaling fines to an operator's size and financial capacity — for example, reduced fine ceilings for micro-enterprises, instalment payment options, or formal consideration of funding stage in the penalty calculation.

Can a provider face penalties in multiple Member States for the same AI system?

Potentially yes. If an AI system is placed on the market in multiple Member States and infringes the AI Act in each, the market surveillance authority in each Member State could take enforcement action under its national penalty rules. However, the principle of ne bis in idem (prohibition of double jeopardy) and the coordination mechanisms under Article 74 should prevent duplicative penalties for the same infringement.