3.5 — Enforcement and Timeline
The EU AI Act uses a phased enforcement timeline, with different provisions taking effect at different dates. This approach gives organizations time to prepare for compliance while ensuring the most critical prohibitions take effect first. Understanding this timeline is essential for exam preparation.
Penalties and Enforcement Structure
| Violation Type | Maximum Fine (EUR) | Alternative (% Global Turnover) | SME/Startup Cap |
|---|---|---|---|
| Prohibited AI Practices | Up to 35 million EUR | 7% of global annual turnover | Proportionate, lower caps apply |
| High-Risk System Violations | Up to 15 million EUR | 3% of global annual turnover | Proportionate, lower caps apply |
| GPAI Model Violations | Up to 15 million EUR | 3% of global annual turnover | Proportionate, lower caps apply |
| Incorrect/Misleading Information to Authorities | Up to 7.5 million EUR | 1% of global annual turnover | Proportionate, lower caps apply |
National Competent Authorities and Market Surveillance Authorities enforce the Act in each EU member state. Each member state must designate at least one notifying authority and one market surveillance authority. The European AI Office (within the European Commission) handles enforcement for GPAI models at the EU level and coordinates across member states.
AI Literacy (Article 4) is a cross-cutting obligation that took effect alongside the prohibitions in February 2025. It requires all providers and deployers to ensure sufficient AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. The level of literacy must account for technical knowledge, experience, education and training, the context of use, and the persons or groups affected.
AI Literacy (Article 4) is frequently tested because candidates overlook it. Key facts: (1) It applies to ALL providers and deployers, not just high-risk. (2) It took effect in February 2025, making it one of the EARLIEST obligations. (3) It is NOT limited to technical staff — it covers anyone dealing with AI systems. (4) The required literacy level is context-dependent, not a fixed standard.
The penalty amounts are the HIGHER of the fixed EUR amount or the percentage of global annual turnover, whichever is greater. For companies that are part of a larger group, global annual turnover refers to the entire group's worldwide turnover. SMEs and startups receive proportionate caps to avoid disproportionate penalties that could threaten their viability.