For businesses in the US and Europe using or commissioning AI, this page records the fines and orders European regulators have issued over AI so far, what they were for and whether they held, and explains the AI Act's penalties, who they reach and who enforces them.
What you'll learn
- Which AI and automated-decision cases European regulators have decided, with amounts and status
- Why the largest fine so far punished a decision without human review
- What AI companies were fined for, and which fines did not hold
- How high AI Act fines can be, and the lower cap for small businesses
- When AI Act penalties apply, who they reach and who enforces them
- What a small business using AI should check first
Europe's AI fines so far have come under the GDPR, not the AI Act, and the largest punished a decision with no person in it: in August 2026 the Dutch data protection authority fined Uber €824,990,000 for deactivating drivers automatically. Other cases hit facial recognition, chatbots without age checks and AI trained without a legal basis, and not all of them have held: a Rome court annulled Italy's €15 million fine against OpenAI in March 2026. The AI Act's own penalties, up to €35 million or 7% of turnover, have applied since August 2025, and Germany named its enforcer in July 2026. This page sets out the decisions in the record with their status, the AI Act's penalty tiers and what they mean for a small business.
Ask what AI fines look like in Europe and most answers jump to the AI Act's headline figure of €35 million. The record so far tells a different story. Every fine involving AI in this record was issued under the GDPR, and the largest punished software that made decisions about people without a person checking first.
This page sets out the decisions in the record, each with its date, regulator, amount and current status. It then explains the AI Act's penalty tiers, when they apply, who they reach and who enforces them, and what a small business should check first.
Which AI fines have European regulators issued so far?
In this record, European data protection authorities have fined AI and automated-decision systems under the GDPR since 2021, with amounts from €158,000 to €824,990,000. They run from Italy's €2.6 million fine on the delivery platform Foodinho in July 2021 to the Dutch authority's €824.99 million fine on Uber, announced on 21 August 2026.[3][9]
| Announced | Company | Amount | What for | Status, Oct 2026 |
|---|---|---|---|---|
| 5 Jul 2021, Italy | Foodinho (Glovo) | €2.6m | Algorithms assigning riders' work, with no way to contest their decisions[3] | Decided |
| 9 Mar 2022, Italy | Clearview AI | €20m | Facial-recognition database built without a legal basis; transparency[1] | Deletion and ban ordered |
| 3 Sep 2024, Netherlands | Clearview AI | €30.5m + up to €5.1m penalty payments | Biometric database of more than 30 billion photos; access requests ignored[2] | Final; no objection filed |
| 22 Nov 2024, Italy | Foodinho (Glovo) | €5m | Automatic account deactivations with no right to contest or to human intervention; facial recognition of riders[4] | Human review ordered |
| 20 Dec 2024, Italy | OpenAI | €15m | ChatGPT's legal basis, transparency, age checks, breach notification[5] | Annulled by Rome court, 18 Mar 2026[5] |
| 19 May 2025, Italy | Luka (Replika) | €5m | No legal basis, inadequate privacy policy, no age verification[6] | Appeal pending[6] |
| 28 May 2026, Italy | Italian start-up | Warning, no fine | AI plug-in estimating employees' stress from Slack and Teams chats; AI Act ban on emotion recognition at work cited[7] | Warning |
| 9 Jul 2026, Italy | Character.AI | €158,000 | Privacy notice, late impact assessment, late EU representative, age verification[8] | Measures due within 120 days[8] |
| 21 Aug 2026, Netherlands | Uber | €824.99m | Fully automated deactivation of drivers; drivers not informed[9] | Appealed; practice stopped[9] |
Two regulators stand out. Italy's Garante appears in seven of the nine rows, and the Dutch Autoriteit Persoonsgegevens issued the two largest amounts. Other European regulators also fined Clearview AI before the Dutch decision, the Dutch authority noted in 2024.[2]
The record includes one warning as well as the fines, because it is the decision in this record that cites the AI Act. Italy's authority warned a start-up whose plug-in used AI to estimate employees' stress, citing the AI Act's ban on systems that infer emotions in the workplace.[7]
What is the largest AI-related fine in Europe?
The largest in this record is €824,990,000, imposed on Uber by the Dutch data protection authority and announced on 21 August 2026. Between 2018 and 2022, Uber's software automatically deactivated drivers' accounts on suspected fraud or low customer ratings, with "no human assessment", which the authority found breached the GDPR's ban on fully automated decisions.[9]
The decision turns on Article 22 of the GDPR: people have the right not to be subject to a decision "based solely on automated processing" that has legal or similarly significant effects on them.[13] Losing access to the income Uber provided was such an effect. The authority also found that Uber had not told drivers enough about the automated decisions.[9]
The largest AI-related fine in Europe so far did not punish a chatbot. It punished software that deactivated drivers without a person looking first.
The size follows the GDPR's formula. Fines can reach 4% of a company's worldwide annual turnover, and Uber's 2025 turnover was around €44.5 billion, the authority noted.[9] Uber has stopped the practice and appealed, and there is no final court decision yet.[9]
The case started small. 171 French drivers went to a human rights organisation, which complained to the French regulator, and the Dutch authority took over because Uber's European headquarters are in the Netherlands.[9] Complaints from affected people, not inspections, start many of these cases.
What were AI companies fined for?
The fines in this record fall into four patterns: processing without a legal basis or proper information, missing age checks, decisions about people with no human review, and biometric data. Italy's €5 million fine on Replika in May 2025 combined the first two, and the Uber and Foodinho fines of 2024 and 2026 are the clearest examples of the third.[6][9][4]
No legal basis, poor information. Clearview built its database without an adequate legal basis and did not inform people properly.[1] Replika's operator had not identified the legal basis for its processing and its privacy policy was inadequate in several respects.[6] Character.AI's privacy notice fell short too.[8] These are the oldest GDPR duties, applied to a new kind of system.
Missing age checks. Replika had no mechanism to verify users' age even though it said minors were excluded.[6] Character.AI's age verification was found wanting, and its minors' profiles must now be private by default.[8] Any AI product that talks to the public meets this question sooner or later.
Decisions with no person in them. Foodinho's platform deactivated riders' accounts with a single standard message that did not tell them they could contest, and riders had no right to human intervention.[4] Three years earlier, Foodinho had already been fined because riders could not contest the algorithms' decisions.[3] Uber's deactivations ran with no human assessment at all.[9] These are the cases most relevant to businesses that put AI into their own processes.
Biometric data. Clearview turned scraped photos into biometric codes for facial recognition; the Dutch authority treated those codes like fingerprints, data whose collection is in principle banned.[2] Foodinho was also ordered to stop the facial recognition it used to verify riders' identity.[4]
Do AI fines stick?
Not always. A Rome court upheld OpenAI's challenge to Italy's €15 million ChatGPT fine in a judgment published on 18 March 2026, and the Garante removed its decision from its website.[5] Replika's €5 million fine and Uber's €824.99 million fine are both under appeal.[6][9] A fine announced is not a fine paid.
Clearview AI shows the other problem. Its Dutch fine is final, because Clearview did not object to it.[2] But the company has no establishment in Europe, and the Dutch authority said in 2024 that other European regulators had fined it before without changing its behaviour. It is examining whether Clearview's directors can be held personally liable.[2]
For a business deciding how worried to be, both lessons matter. Large headline fines against big AI providers are slow and contested. A small European company with its assets and directors in the EU is easier to reach. It is also less likely to fight a decision through the courts for years.
Fines are not the only exposure. People harmed by an AI decision can also claim damages, which is a separate question from regulatory penalties. Our guide to AI agent liability in Europe covers that side, and our page on ChatGPT and the GDPR covers the OpenAI case in detail.
How high can fines under the AI Act be?
The AI Act sets three tiers in Article 99: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for misleading information to authorities, whichever is higher for large companies.[10] The text on the Commission's AI Act Service Desk was consolidated on 27 July 2026, including the Digital Omnibus amendments.[10]
| Breach | Maximum fine | Article |
|---|---|---|
| Prohibited AI practices, such as emotion recognition at work | €35 million or 7% of worldwide turnover | 99(3), Article 5[10] |
| Obligations of providers, importers, distributors and deployers, including transparency | €15 million or 3% | 99(4), including Articles 16, 26 and 50[10] |
| Incorrect, incomplete or misleading information to authorities | €7.5 million or 1% | 99(5)[10] |
The middle tier is the one most businesses meet. It covers the deployer obligations in Article 26, which apply to businesses using high-risk AI systems, and the transparency obligations in Article 50, which apply to chatbots, AI agents and AI-generated content.[10] Our guide to what the EU AI Act asks of deployers explains when each applies.
For comparison, the GDPR's top tier is €20 million or 4% of worldwide turnover, whichever is higher.[13] Uber's fine shows how far that percentage can reach.
Do small businesses pay less under the AI Act?
Yes. Under Article 99(6), each AI Act fine for small and medium-sized enterprises, including start-ups, is capped at whichever of the two amounts is lower: the fixed euro sum or the turnover percentage.[10] An amendment consolidated in July 2026 extends the same lower-amount rule to small mid-caps for the €15 million and €7.5 million tiers.[10]
The difference is large. For a large company, the AI Act takes the higher of €15 million or 3% of turnover. For an SME with €5 million in annual turnover, the same breach is capped at 3% of turnover, €150,000, because that is lower than €15 million. That example is arithmetic on the Article 99 formula; a regulator sets the actual amount case by case within the cap.
That asymmetry matters more than the headline numbers. A small business's largest exposure from AI today is more likely to come from the GDPR than from the AI Act, because the GDPR has no small-business cap and its duties have applied since 2018.[13]
When do AI Act fines apply?
The AI Act's penalty chapter has applied since 2 August 2025, and its prohibitions since 2 February 2025, according to Article 113.[11] Most other obligations, including the transparency rules in Article 50, apply from 2 August 2026. The duties for high-risk AI systems come later, from 2 December 2027 or 2 August 2028 depending on the system. Fines on providers of general-purpose AI models under Article 101 follow a separate timetable.[11]
| Date | What applies |
|---|---|
| 2 February 2025 | Chapters I and II: definitions, AI literacy (Article 4) and prohibited practices (Article 5)[11] |
| 2 August 2025 | Chapter XII: penalties, except Article 101[11] |
| 2 August 2026 | General application, including Article 50 transparency[11] |
| 2 December 2026 | Additional Article 5 prohibitions added by amendment (Article 5(1a) and (1b))[11] |
| 2 December 2027 | High-risk duties for systems listed in Annex III, such as AI used in hiring or to evaluate workers[11] |
| 2 August 2028 | High-risk duties for AI in products covered by Annex I, such as machinery and medical devices[11] |
A penalty needs both an obligation that applies and an authority that can enforce it. Each member state has to supply the second piece, as the next section explains.
Who enforces the AI Act?
National authorities in each EU member state enforce most of the AI Act, and the European Commission enforces the rules for general-purpose AI models. Article 70 requires every member state to designate at least one market surveillance authority, and Article 88 gives the Commission exclusive powers over general-purpose models, carried out by its AI Office.[14][15] In Germany, the law on market surveillance and innovation for artificial intelligence (KI-MIG) made the Bundesnetzagentur the market surveillance authority, contact point and complaints office on 29 July 2026.[12]
The Act also reaches beyond the EU. It applies to providers and deployers outside the Union when the output produced by their AI system is used in the Union.[16] A US company whose chatbot answers customers in Europe, for example, falls under the same transparency duties as a European one.
Data protection authorities remain responsible for the GDPR, which is where the fines in this record came from. In practice, a business using AI in the EU can face two regulators for one system: the data protection authority looks at the personal data, and the market surveillance authority looks at the AI Act duties. A chatbot that collects customer data and does not say it is an AI could interest both.
National authorities are also building help for smaller firms. Germany's Bundesnetzagentur, for example, runs a KI-Service Desk for small businesses and start-ups, with an online tool for a first assessment of an AI system's risk class.[12]
Is there a fine for missing AI labels or AI literacy?
Missing transparency can be fined; AI literacy is not on Article 99's list. Breaches of the Article 50 transparency obligations, such as not telling people they are dealing with an AI, fall in the €15 million or 3% tier, with the lower cap for SMEs.[10] Article 4, the duty to support the development of staff's AI literacy, does not appear among the obligations Article 99 lists for fines.[10]
That does not make AI literacy optional. Article 4 has applied since 2 February 2025.[11] If an untrained employee misuses an AI system and causes a breach that is fineable, such as a prohibited practice or a GDPR violation, the missing training will not help in the regulator's assessment.
The AI labelling question is the more practical one. Since 2 August 2026, chatbots, AI agents and AI phone assistants must be designed to make clear to people that they are dealing with an AI, unless it is obvious.[11][10] Of all the AI Act duties, this is the one most small businesses meet first, and it is cheap to fulfil: one sentence at the start of the conversation.
What does this mean for a small business using AI?
For most small businesses, the realistic risk is a GDPR case about a decision or a data use, not an AI Act fine for a prohibited system. The Uber and Foodinho fines of 2024 and 2026 show what regulators punish: automated decisions about people with no human review and no way to contest them.[9][4] These five steps address the patterns in the record.
Find the decisions that affect people
Put a person in front of them
Write down the legal basis and tell people
Check age if the public can use it
Say it is an AI
Steps 1 and 2 are about design, not paperwork. An AI system can prepare a decision and still leave the decision to a person: our guide to approval workflows in an AI agent system shows how. For the full list of GDPR duties, see GDPR for AI agents. If you use AI in sales, our guide to cold email and calling rules for sales AI covers the outreach rules. A custom agent can be built with those review points from the start.
Frequently asked questions
Has anyone been fined under the EU AI Act yet? The European fines involving AI in this record were all issued under the GDPR. The AI Act's penalty rules have applied since 2 August 2025, and member states are putting their enforcers in place: Germany's law took effect on 29 July 2026. In May 2026 Italy's data protection authority cited the AI Act's ban on emotion recognition at work in a warning to a start-up, but that was a warning, not a fine.
How high are fines under the AI Act? Article 99 of the AI Act sets three tiers: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations including transparency under Article 50, and up to €7.5 million or 1% for misleading information to authorities. For SMEs each fine is capped at whichever of the two amounts is lower.
What is the largest AI-related fine in Europe? In this record, the largest is €824,990,000 imposed on Uber by the Dutch data protection authority, announced on 21 August 2026. Uber's software automatically deactivated drivers' accounts on suspected fraud or low ratings between 2018 and 2022, without human assessment, which breached Article 22 of the GDPR. Uber has appealed.
Who enforces the AI Act? Each EU member state designates at least one market surveillance authority, and the European Commission's AI Office enforces the rules for general-purpose AI models. In Germany, for example, the Bundesnetzagentur took on the role when the KI-MIG law took effect on 29 July 2026. Data protection authorities continue to enforce the GDPR. The Act also covers companies outside the EU when their AI system's output is used in the EU.
Notes
- Garante per la protezione dei dati personali, press release on Clearview AI, March 9, 2022, accessed October 15, 2026.
- Autoriteit Persoonsgegevens, AP legt Clearview boete op voor illegale dataverzameling voor gezichtsherkenning, September 3, 2024, accessed October 15, 2026.
- Garante per la protezione dei dati personali, press release on Foodinho, July 5, 2021, accessed October 15, 2026.
- Garante per la protezione dei dati personali, press release on Foodinho, November 22, 2024, accessed October 15, 2026.
- Garante per la protezione dei dati personali, press release on the ChatGPT investigation, December 20, 2024, with the note on Tribunale di Roma judgment 4153/2026 published March 18, 2026, accessed October 15, 2026.
- Garante per la protezione dei dati personali, press release on Replika, May 19, 2025, accessed October 15, 2026.
- Garante per la protezione dei dati personali, press release on an AI stress-detection plug-in, May 28, 2026, accessed October 15, 2026.
- Garante per la protezione dei dati personali, press release on Character.AI, July 9, 2026, accessed October 15, 2026.
- Autoriteit Persoonsgegevens, Uber fined nearly 825 million euros for automated driver blocking, August 21, 2026, and European Data Protection Board national news, October 8, 2026, accessed October 15, 2026.
- AI Act Service Desk, Article 99: Penalties, consolidated text as of July 27, 2026, accessed October 15, 2026.
- AI Act Service Desk, Article 113: Entry into force and application, consolidated text as of July 27, 2026, accessed October 17, 2026.
- Bundesnetzagentur, press release on the KI-MIG, July 29, 2026, accessed October 15, 2026.
- Regulation (EU) 2016/679 (GDPR), Articles 22 and 83, accessed October 15, 2026.
- AI Act Service Desk, Article 70: Designation of national competent authorities and single points of contact, accessed October 15, 2026.
- AI Act Service Desk, Article 88: Enforcement of the obligations of providers of general-purpose AI models, accessed October 15, 2026.
- AI Act Service Desk, Article 2: Scope, accessed October 15, 2026.
