Fines for Non-Compliance with the EU AI Act: What Threatens SMEs

The maximum fine for non-compliance with the EU Artificial Intelligence (AI) Act can reach €35 million or 7% of a company’s global annual turnover - whichever is higher. This is the highest fine level set out in Regulation (EU) 2024/1689, and it applies only to the most serious violations, such as the use of prohibited AI systems. However, for micro-enterprises that simply use tools like ChatGPT in their daily work, the real sanctions under the AI Act look very different - and this is precisely the part that is important to understand, so as not to overestimate or underestimate the risk.

For small businesses, the most important thing is to distinguish between the theoretical maximum fine level and the real day-to-day risk: most often, the problem is not a malicious violation, but the absence of any proof of compliance.

What Are the Three Levels of Fines Under the AI Act?

The EU AI Act establishes a tiered fine system. The fine depends on the nature of the violation - not the size of your company. Below are the three main levels.

Article 4 does not specify its own fine amount. The limits in this table must not be presented as an automatic fine for failing an AI literacy test or lacking a certificate.

An important detail for SMEs: the Regulation clearly states that for small and medium-sized enterprises (SMEs) and startups, the lower of the two limits applies - either the fixed amount or the percentage, whichever is smaller. This means that for micro-enterprises, the percentage cap effectively acts as protection against disproportionate fines, rather than a threat.

In other words, while a large corporation might face a percentage of its multi-billion turnover for the same violation, a small business’s upper limit will be tied to its modest turnover. The legislator intentionally included this provision to ensure the regulation does not stifle small businesses and innovation. Therefore, the first thing to do when confronted with alarming headlines is to check which of the three levels applies to your specific case and whether the violation is even related to your activities.

Are Million-Euro Fines Realistically a Threat to SMEs?

The short answer is no - million-euro fines are highly unlikely for micro-enterprises. The relevant limit depends on the specific infringement, role and SME provisions; deployer status alone does not exempt a company. Most Lithuanian micro-enterprises are merely AI deployers (users) - they use existing tools for marketing, text generation, accounting, or customer service.

For users, the most realistic risks are:

• Failure to comply with AI literacy obligations. This is the most common and concrete obligation for SMEs. Since 2 February 2025, Article 4 requires that companies (regardless of size) take measures to support the development of AI literacy among employees and relevant persons involved in AI system use, considering their knowledge, experience, training, context, and affected individuals. This does not mean guaranteeing a specific or sufficient individual level. More on this in the Article 4 requirements article.
• Transparency violations. If you use AI for customer service (e.g., chatbots) or generate synthetic content, users must be informed that they are interacting with AI or viewing AI-generated content.
• Inability to demonstrate compliance. If a supervisory authority asks how you manage AI use, having no documentation puts you in a weak position.

More misconceptions about what “really” and “does not” threaten businesses are clarified in the article EU AI Act: Myths and Facts.

When Do AI Act Obligations Come Into Force?

AI Act sanctions cannot be applied before the corresponding obligations take effect. The Regulation enters into force gradually, so it is important to know the dates - there can be no fine for a non-yet-applicable obligation.

As you can see, the AI literacy obligation under Article 4 has been in force since 2 February 2025, and general-purpose AI model rules began applying on 2 August 2025, subject to transitional provisions, and general application and enforcement provisions followed on 2 August 2026. This means that the requirement to support AI literacy development is not a future plan, but an already active obligation. More on who exactly the EU AI Act applies to can be found in the article Who Does the EU AI Act Apply To?.

How Do Supervision and Fine Imposition Work in Practice?

It is important to understand that fines are not imposed automatically or randomly. The EU AI Act requires that sanctions be effective, proportionate, and dissuasive, and that the following circumstances be considered when imposing a fine:

1. The nature and gravity of the violation - whether it involves a prohibited practice or merely a documentation gap.
2. The size and market position of the company - micro-enterprises are subject to a separate, more favourable assessment.
3. Whether the violation was intentional or due to negligence.
4. Whether the company cooperated with authorities and took corrective actions.
5. Whether there have been previous violations.

In practice, this means that a company with a prepared AI usage policy, a tool registry, and evidence of employee training will be in a completely different position than a company that cannot provide any documentation in response to a request. In the first case, even if something is missing, good faith and effort are evident - in the second case, negligence is evident.

Lithuania’s supervisory system is still being formed, but the principle is clear: documentation and demonstrable literacy are your primary protection. The official text of the Regulation can be found on the EUR-Lex website (eur-lex.europa.eu, Regulation (EU) 2024/1689), while practical information is published on the European Commission’s Digital Strategy page.

What Is the Biggest Hidden Risk?

The biggest risk for SMEs is not the fine itself - it is the inability to prove compliance when requested. Many managers think, “We’re not doing anything wrong, we’re just using ChatGPT,” and this is often true. The problem is that “we’re not doing anything wrong” is not a document. When a supervisory authority, a client in a major tender, or an auditor asks for specifics, you will need to show:

• which AI tools the company uses and for what purpose (AI tool registry solves this);
• what internal AI usage rules are in place;
• what measures support employee AI literacy under Article 4;
• how personal data and confidentiality risks are managed when using AI.

Without these documents, even a completely honest company may appear non-compliant. With them, even a minor gap looks like a technicality, not negligence.

There is also a second hidden risk that is rarely discussed: competitive and commercial losses. Increasingly, larger clients, public sector procurement organisers, and partners are asking suppliers how they manage AI use. If you cannot provide even a basic AI usage policy, you may lose a contract long before the issue of fines arises. In this sense, compliance becomes not just a legal obligation, but a sales argument - a proof that you are a serious, well-organised partner.

What Should SMEs Do in Practice?

The good news is that compliance at the user level is entirely achievable with standardised measures and without major costs. Below are concrete steps that any company with 1 - 30 employees can take:

1. Inventory where you use AI. List all tools - from ChatGPT to AI features in accounting software. This forms the basis of your AI tool registry.
2. Write a brief AI usage policy. Define what employees are allowed to do and what they are not (e.g., do not input client personal data into public tools).
3. Support employee AI literacy. This is already an active obligation under Article 4 - measures are required to support AI literacy development, such as basic training with a knowledge check. You can start with free AI literacy training. Note: There are no universal requirements to obtain specific certificates, fixed training hours, use external trainers, conduct audits, or appoint a dedicated AI officer. Our documents and quizzes are a practical suggestion, not a mandatory legal minimum or a guarantee of compliance. The free path is for one signed-in participant; team training is included in the paid documentation package.
4. Maintain a compliance record. So you can prove what actions you took and when.
5. Update periodically. AI tools change rapidly, so documents must evolve - not gather dust on a shelf.

All these documents can be prepared manually, but this takes time and requires a deep dive into the regulation. An alternative is an automated solution: nebedirbam.lt uses compliance expert-reviewed templates to automatically generate a practical documentation package (AI usage policy, tool registry, compliance record, employee AI guide, and AI literacy training with certificates) for a fixed €149 + VAT (€299) price, with no hourly fees. More on whether you need a lawyer for AI compliance can be found in the article Do You Need a Lawyer for AI Compliance?.

Regarding the question of whether AI tools can be used with personal data: The EU AI Act does not introduce a blanket ban. You must assess the lawful basis, data minimisation, use approved tools, and implement appropriate safeguards. The ban applies only to unapproved or public tools without adequate protections. More: EU AI Act: Myths and Facts.

What Is Most Important to Remember?

AI Act fines sound alarming, but for SMEs, reality is much calmer than headlines about €35 million suggest. Three things to keep in mind:

• The highest fines are for serious violations and major players, while micro-enterprises are subject to lower caps.
• The most realistic risk is the inability to prove compliance, not the fine itself.
• The AI literacy obligation has been in force since 2 February 2025, so there is no time to delay.

The best protection against AI Act non-compliance is not worry, but a simple set of documents and trained employees. More practical topics can be found in the full list of articles.

---

The information in this article is based on official EU AI Act (Regulation (EU) 2024/1689) sources: AI Act Service Desk - Article 4 and European Commission Digital Strategy page.