Legalithm logo
Chapter XII — PenaltiesArticle 98

Article 98: Administrative Fines on Union Institutions, Bodies, Offices and Agencies

Applies from 2 Aug 20267 min readEUR-Lex verified Apr 2026

Article 98 establishes the committee procedure for the AI Act. The Commission is assisted by a committee within the meaning of Regulation (EU) No 182/2011 (the Comitology Regulation). Where reference is made to Article 98(2), the examination procedure under Article 5 of that Regulation applies. This committee supports the Commission in adopting implementing acts under the AI Act.

Start free assessmentAll articles

Who does this apply to?

  • -EU institutions, bodies, offices and agencies acting as providers or deployers of AI systems
  • -The European Data Protection Supervisor (EDPS) as the enforcement authority for Union bodies
  • -Compliance teams within EU institutions responsible for AI governance
  • -AI providers supplying systems to EU institutions (indirectly — the institution as deployer bears the obligation)

Scenarios

An EU agency deploys a social scoring AI system to prioritise enforcement actions against companies, assigning general trustworthiness scores based on social behaviour data. This constitutes a prohibited practice under Article 5.

The EDPS may impose a fine of up to EUR 1,500,000 on the EU agency for violating the Article 5 prohibition on social scoring AI systems.
Ref. Art. 98(1)(a), Art. 5

An EU body uses a high-risk AI system for staff recruitment without completing the required fundamental rights impact assessment under Article 27 or registering the system in the EU database under Article 49.

The EDPS may impose a fine of up to EUR 750,000 for non-compliance with the AI Act's high-risk obligations. The EDPS will consider mitigating factors such as whether the body cooperated and took remedial action.
Ref. Art. 98(1)(b)

What Article 98 does (in plain terms)

Article 98 closes a gap that would otherwise exempt EU institutions from the AI Act's fine regime. Just as Article 99 empowers national authorities to fine private actors and just as the GDPR's counterpart (Regulation 2018/1725) subjects EU institutions to data protection enforcement, Article 98 ensures that EU-level public bodies face financial consequences for AI Act non-compliance.

Two fine tiers:

| Infringement | Maximum fine | |---|---| | (a) Prohibited practices under Article 5 | EUR 1,500,000 | | (b) Non-compliance with any other AI Act provision | EUR 750,000 |

Key design choices: - The EDPS acts as the sole enforcement authority — not national market surveillance authorities. - Fine ceilings are substantially lower than those for private actors under Article 99 (EUR 35M / EUR 15M / EUR 7.5M), reflecting that EU institutions operate on public budgets. - The EDPS must consider mitigating and aggravating criteria analogous to Article 99(7): nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate; cooperation with the investigation; and previous infringements.

How Article 98 connects to the rest of the Act

  • Article 5 — Prohibited practices: Tier (a) fines under Article 98 target violations of these prohibitions by EU bodies.
  • Article 99 — Penalties on private actors: Article 98 is the parallel regime for Union bodies, using the same criteria structure but lower ceilings.
  • Article 100 — GPAI model fines: a separate regime for general-purpose AI model providers; Article 98 covers EU institutions acting as deployers or providers of application-level AI.
  • Regulation (EU) 2018/1725 (EUDPR) — The EDPS already oversees data protection compliance by EU institutions; Article 98 extends this oversight to AI Act compliance.
  • Article 113 — Application dates: Article 98 applies from 2 August 2026, but Article 5 prohibitions have applied since 2 February 2025.

Practical guidance for EU institutions

EU institutions deploying AI systems should treat Article 98 as a signal that the AI Act applies to them with real financial teeth:

1. Audit current AI use — Inventory all AI systems used by the institution, classify them under the AI Act's risk tiers, and check for any Article 5 prohibited practices. 2. Appoint an AI compliance function — Coordinate with the institution's Data Protection Officer (who liaises with the EDPS on EUDPR matters) to cover AI Act obligations. 3. Complete fundamental rights impact assessments — As deployers, EU institutions using Annex III high-risk systems must comply with Article 27 (FRIA) requirements. 4. Register in the EU database — Article 49 requires deployers of high-risk systems to register; EU institutions are not exempt. 5. Establish cooperation channels with the EDPS — Proactive engagement and self-reporting are mitigating factors under the criteria the EDPS must apply. 6. Budget for compliance — While EUR 1.5M may seem modest compared to private-sector fines, it is material for public bodies and signals institutional failure.

Official wording: Article 98

Article 98

Committee procedure

1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

Recitals and legislative context

Recitals 164–165 explain the rationale for subjecting EU institutions to the fine framework. They emphasise institutional accountability — EU bodies should not be exempt from the rules they impose on private actors. The recitals also note the coordination with the EUDPR (Regulation 2018/1725), under which the EDPS already supervises EU institutions' data processing activities. Article 98 extends this oversight model to AI Act compliance.

Use the official preamble on EUR-Lex to read the recitals in full.

Compliance checklist

  • Inventory all AI systems deployed or provided by the EU institution and classify them under the AI Act's risk framework.
  • Conduct an Article 5 audit to confirm no prohibited AI practices are in use (highest fine tier).
  • Appoint or designate an AI compliance function within the institution, coordinating with the existing Data Protection Officer.
  • Complete fundamental rights impact assessments (Article 27) for all Annex III high-risk AI deployments.
  • Register high-risk AI systems in the EU database under Article 49.
  • Establish a cooperation protocol with the EDPS for AI Act matters, separate from existing EUDPR interactions.
  • Document all compliance actions, risk mitigations, and internal decisions for use as mitigating evidence under Article 98 criteria.
Read the official text on EUR-Lex

Assess your institution's AI Act exposure — start the free assessment.

Start Free Assessment

Frequently asked questions

Why are the fines for EU institutions so much lower than for private companies?

EU institutions operate on public budgets funded by Member States, not on commercial revenue. The lower ceilings (EUR 1.5M vs EUR 35M) reflect this reality while still providing a meaningful deterrent and institutional accountability signal. The EDPS also has non-monetary enforcement tools (recommendations, reprimands) that complement fines.

Who within the EU institution is liable — the institution itself or individual officials?

Article 98 imposes fines on the institution, body, office, or agency as an entity — not on individual officials. However, individual liability under EU staff regulations or national law may apply separately for officials who knowingly directed non-compliant AI use.

Does Article 98 also apply to the Commission itself?

Yes. 'Union institutions, bodies, offices and agencies' includes the European Commission, Parliament, Council, and all EU agencies. Any of these acting as an AI provider or deployer falls within the EDPS's enforcement scope under Article 98.