Article 91: Common Provisions on Penalties
Article 91 provides the common rules for calculating penalties under the AI Act. When deciding on the amount of administrative fines, authorities must take into account: the nature, gravity, and duration of the infringement; whether fines have already been imposed by other authorities for the same infringement; the size and market share of the operator; the intentional or negligent character of the infringement; actions taken to mitigate damage; degree of cooperation with authorities; previous infringements; and the manner in which the infringement became known, including whether the operator self-reported. Always verify on EUR-Lex.
Who does this apply to?
- -National authorities calculating the amount of administrative fines for AI Act infringements
- -Providers and deployers facing enforcement proceedings who need to understand how penalty amounts are determined
- -Courts reviewing the proportionality of fines imposed under the AI Act
Scenarios
A large multinational provider of a high-risk AI hiring system is found to have deliberately omitted bias-testing data from its conformity assessment documentation under Article 43. This is the provider's second infringement in three years. The national market surveillance authority calculates the fine under Article 91 criteria.
A start-up deploying an AI customer service chatbot fails to provide the required transparency disclosure under Article 50 (users are not informed they are interacting with AI). The start-up immediately corrects the issue upon receiving notice from the market surveillance authority, cooperates fully with the investigation, and self-reports a related transparency gap in another product.
What Article 91 does (in plain terms)
Article 91 ensures that fines under the AI Act are calculated consistently and fairly across Member States. Rather than leaving fine calculation entirely to national discretion, it provides a mandatory list of factors that every authority must consider:
1. (a) Nature, gravity, and duration — More serious and longer-lasting infringements warrant higher fines. A deliberate deployment of a prohibited AI system is graver than a late filing of documentation. 2. (b) Prior fines by other authorities — The *ne bis in idem* principle: if another authority has already fined the operator for the same infringement, this must be considered to avoid disproportionate cumulative sanctions. 3. (c) Size and market share — Larger operators with more resources and market power face higher fines; smaller operators face lower amounts. This dovetails with Article 90's SME sensitivity requirement. 4. (d) Intentional or negligent character — Deliberate non-compliance is punished more severely than honest mistakes or oversight. 5. (e) Actions taken to mitigate damage — Operators who promptly fix problems and compensate affected parties receive credit. 6. (f) Degree of cooperation — Full cooperation with the investigating authority is a mitigating factor; obstruction or delay is aggravating. 7. (g) Previous infringements — Repeat offenders face escalating fines; first-time offenders benefit from a clean record. 8. (h) Manner of discovery — Self-reporting is rewarded. Infringements discovered only through third-party complaints, whistleblowers, or audits may be treated less favourably.
How Article 91 connects to the rest of the Act
- Article 90 — Penalties: Article 90 requires Member States to establish penalty rules; Article 91 provides the common criteria that national authorities must apply when calculating fine amounts under those rules.
- Article 99 — Administrative fines: Article 99 sets the ceiling amounts (EUR 35M/7%, EUR 15M/3%, EUR 7.5M/1%); Article 91 determines where within those ceilings a specific fine falls.
- Article 113 — Application dates: Article 91 applies from 2 August 2026.
Practical guidance: building your mitigation case
For providers and deployers facing potential enforcement action, Article 91 provides a roadmap for reducing fine amounts:
1. Cooperate immediately and fully — Factor (f) rewards cooperation. Provide requested information promptly, grant access to documentation, and avoid obstructive behaviour. A cooperative posture can materially reduce the fine. 2. Self-report issues — Factor (h) rewards self-reporting. If you discover non-compliance internally, consider proactively notifying the market surveillance authority. This converts an aggravating discovery scenario into a mitigating one. 3. Mitigate damage swiftly — Factor (e) credits actions taken to mitigate damage. Immediately patch, recall, or suspend a non-compliant AI system and notify affected parties. 4. Document intent — Factor (d) distinguishes intentional from negligent infringements. Maintain records of compliance efforts, training, and risk assessments to demonstrate that any infringement was not deliberate. 5. Maintain a clean record — Factor (g) penalises recidivism. Invest in proactive compliance to avoid building an enforcement history that would escalate future fines.
Compliance checklist
- Document all compliance efforts, risk assessments, and training activities to demonstrate non-intentional character in case of infringement (Art. 91(d)).
- Establish rapid-response procedures for self-reporting discovered non-compliance to benefit from the self-reporting mitigating factor (Art. 91(h)).
- Define an internal cooperation protocol for responding to market surveillance authority investigations fully and promptly (Art. 91(f)).
- Maintain a corrective action register documenting all steps taken to mitigate damage from any identified non-compliance (Art. 91(e)).
- Track enforcement history across all Member States to understand your repeat-offender risk profile (Art. 91(g)).
- Prepare a mitigation brief template that maps your circumstances to each Article 91 factor for use in any enforcement proceeding.
Prepare your mitigation strategy before enforcement — start the free assessment.
Start Free AssessmentRelated Articles
Frequently asked questions
Does Article 91 apply to fines imposed by the Commission on GPAI providers?
Article 91 primarily governs national authority fine calculations. Fines imposed by the Commission on providers of general-purpose AI models under Article 100 follow the Commission's own procedural rules, though similar proportionality principles apply. The EDPS fines under Article 98 for Union institutions also consider analogous factors.
How much weight does self-reporting carry in reducing a fine?
Article 91 does not assign numerical weights to individual factors — it requires authorities to take all listed factors into account as a whole. However, in analogous EU enforcement frameworks (GDPR, competition law), self-reporting combined with full cooperation has historically resulted in significant fine reductions, sometimes 20–50% below what would otherwise be imposed.
Can a small company argue that any fine would threaten its economic viability?
Yes, but indirectly. While Article 91 itself lists size and market share as a factor, the economic viability argument is primarily grounded in Article 90, which requires Member States to consider SME and start-up interests. Together, Articles 90 and 91 require that fines be scaled to an operator's capacity to pay without being driven out of business.