Knowledge base
AI Act fines for SMEs: what do you really risk?
By Bob Biesemans · published on
Fines of up to 35 million euros sound frightening. Which fines apply to which rules, what about AI literacy, and who supervises in Belgium? As of October 2026.
Short answer
The highest AI Act fines, up to 35 million euros or 7% of turnover, apply to prohibited AI. For SMEs the lower amount always applies. For AI literacy (Article 4) the AI Act itself names no fine; Member States set penalties. In Belgium the supervisory authority is not yet designated by law as of October 2026.
The big amounts are about prohibited AI
Article 99 of the AI Act sets the maximum fines. The highest, up to 35 million euros or 7% of worldwide annual turnover, apply to the prohibited AI practices of Article 5, such as manipulation or social scoring. For a set of other obligations, including those of deployers of high-risk AI, the cap is 15 million euros or 3%.
For SMEs and start-ups the lower of the two amounts always applies. Since the Digital Omnibus, Article 99 also expressly asks authorities to consider the economic viability of SMEs, and allows warnings and non-monetary measures.
And for AI literacy?
Article 4 on AI literacy is not in the list of obligations for which the AI Act itself names a fine. Member States do set penalties for infringements of the regulation in general. So there is no fixed European amount for failing to take measures, but that doesn't make it optional.
In practice Article 4 mostly matters when something goes wrong: a data leak through a chatbot, a complaint, a mistake in a quote. The question then is which measures you had taken. Being able to show them puts you in a stronger position.
Who supervises in Belgium?
The federal government agreement 2025-2029 names the BIPT as the central authority for the AI Act. At the time of writing that designation is not yet set in law. Where AI processes personal data, the Data Protection Authority is competent and the GDPR applies in full.
What an SME should do now
Check that you don't use prohibited AI; for most SMEs that is quickly clear. List the AI tools staff use. Take AI literacy measures that fit what each department does, and record them. Measure whether they work. General information, not legal advice; when in doubt, ask a lawyer.
Frequently asked questions
Can I be fined if my staff aren't AI literate?
The AI Act itself names no fine for Article 4. Member States can set penalties, and after an incident authorities look at the measures you took. Taking and recording measures is therefore wise.
Who supervises the AI Act in Belgium?
The 2025-2029 government agreement names the BIPT, but as of October 2026 that is not yet set in law. For personal data, the Data Protection Authority is competent.
Do SMEs face lower fines?
Yes. For SMEs and start-ups the lower of the fixed amount and the turnover percentage applies, and since the Digital Omnibus their economic viability must be considered.