A €35,000,000 fine for missing training? The figure is real, only it belongs to something else.

“Fines of up to €35,000,000 if you do not train your staff in AI.” The sentence turns up in guides, on LinkedIn and occasionally in consultants' proposals. It joins two things that have nothing to do with each other in the law: the maximum penalty of the AI Act and the duty under Article 4 to promote the AI literacy of staff. Anyone who looks in the list of fines will not find Article 4 there.

The list of fines is in Article 99

Article 99 of the AI Act lists exhaustively which breaches of duty can be punished with a fine. Paragraph 4 names seven groups of provisions:

• Obligations of providers (Article 16)
• Obligations of authorised representatives (Article 22)
• Obligations of importers (Article 23)
• Obligations of distributors (Article 24)
• Obligations of deployers of high-risk systems (Article 26)
• Requirements for notified bodies (Articles 31, 33(1), (3) and (4), Article 34)
• Transparency obligations for providers and deployers (Article 50)

Since the Digital Omnibus an eighth group has been added: obligations of providers and operators under Article 25(2) and (4). Article 4, the AI literacy duty, appears in none of these lists. The text of the law contains no separate fining provision for it.

The three actual tiers

Where fines are provided for, Article 99 distinguishes three levels, graded by the type of infringement:

“Non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.” Regulation (EU) 2024/1689, Article 99(3)

That is the figure quoted in the guides, and it belongs to Article 5: the prohibited practices. These include social scoring by public authorities, manipulative techniques meant to influence a person subliminally, and certain forms of biometric categorisation. For the seven groups of duties in Article 99(4), including the transparency obligation in Article 50, the second tier applies: up to €15,000,000 or 3 % of worldwide annual turnover. Anyone who gives an authority incorrect, incomplete or misleading information risks the third tier under paragraph 5: up to €7,500,000 or 1 %.

The built-in protection for smaller companies

Article 99 treats smaller companies differently from the outset. Paragraph 6 lays down that for SMEs and start-ups every fine under this article is automatically capped at the lower of the two possible amounts, that is the percentage or the fixed sum, whichever is lower. Paragraph 1 also requires that penalties be effective, proportionate and dissuasive, and that they take into account the interests of SMEs and their economic viability.

The Digital Omnibus extended this protection in July 2026. Paragraph 1 has since expressly named “small mid-cap enterprises” as well, a new size class just above the SME threshold. And a new paragraph 6a carries the lower-amount rule over to exactly this group, though only for infringements under paragraphs 4 and 5, not for the prohibited practices under paragraph 3.

What really counts when no fine is directly at stake

That Article 4 has no fining provision of its own does not mean that missing training has no consequences. Two other mechanisms work independently of the list of fines.

The first is liability. If a business uses AI and damage results, a dispute turns on organisational fault: did the business do what could be expected of it? In Germany, the Higher Regional Court of Hamm decided in May 2026 that a company is fully answerable for the false statements of its chatbot and that a general notice saying “AI can make mistakes” offers no protection (judgment of 12 May 2026, case no. 4 UKl 3/25, leave to appeal granted). A business that has documented its training is in a different position in such proceedings from one that merely claims to have been prepared.

The second mechanism is competition law, and it concerns Article 50 more than Article 4. In Germany, a business that does not disclose its chat widget as AI risks a warning letter from competitors or from the competition watchdog Wettbewerbszentrale, rather than, in the first instance, proceedings before the AI market surveillance authority. What Article 50 requires in detail is set out in a separate article.

In practice

A business weighing up whether to document something should not hang the question on the size of the fine. The duty under Article 4 exists whether or not a breach carries a penalty, and the record of a measure tends to matter somewhere else: after damage has occurred, in a data protection complaint, in a question from the business's own works council. For the vast majority of small and medium-sized businesses €35,000,000 is a theoretical figure anyway, because it is tied to an entirely different kind of infringement. The documentation duty nevertheless remains the task to deal with first.