AI Act Penalties and Enforcement: What Irish Employers Should Know

The EU AI Act sets maximum fines in three tiers: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations, and up to EUR 7.5 million or 1% for supplying incorrect or misleading information to authorities. Under Article 99, Member States, including Ireland, lay down the rules on penalties and other enforcement measures. This guide explains the AI Act penalties and fines in plain terms, who enforces them in Ireland, and what an employer in Dublin or elsewhere can sensibly do now. The figures below are caps, not standard penalties, and the position is still developing (our guide to EU AI Act key dates for Irish employers tracks the timeline), so treat this as a map to the official pages rather than a prediction.

What Article 99 says

Article 99 of Regulation (EU) 2024/1689 is the penalties article. We read it on the European Commission's AI Act Service Desk, which presents the text of the regulation and says its version reflects the EUR-Lex consolidated text as at 27 July 2026. The page itself notes that its explanatory summary is not legally binding and points readers to EUR-Lex for the authoritative text. (The EUR-Lex pages we tried to open would not display the article text, so we relied on the Service Desk presentation.)

In outline, the article requires Member States to lay down penalties and other enforcement measures, which may include warnings and non-monetary measures as well as administrative fines. They must be effective, proportionate and dissuasive. Fines are capped in tiers:

For small and medium-sized enterprises, including start-ups, the Service Desk summary says each fine is capped at the lower of the percentage and the fixed amount. It also records a similar lower-of rule for small mid-cap companies in the amended text for the second and third tiers. Whether your business falls into either category is a question for the definitions in the regulation, not something we can answer here.

Which tier matters to an employer?

Most employers are "deployers": they use AI systems built by others. The Service Desk summary of the middle tier lists the obligations of providers, authorised representatives, importers, distributors, deployers and notified bodies, and the Article 50 transparency obligations. So a deployer's own duties sit in the EUR 15 million or 3% tier, although the same summary does not tell us how every individual duty, such as the AI literacy requirement in Article 4, is treated. We did not find Article 4 named in the summary of that tier, so check the legal text and the Irish legislation on that point before assuming either way.

The top tier is reserved for the practices the Act bans outright. If you want to confirm none of your tools fall near that line, our guide to prohibited AI practices for Irish employers is the place to start. The third tier is the simplest to avoid: if a regulator or notified body asks for information, give it accurate and complete answers.

How fines are set

The regulation does not make the maximum automatic. The Service Desk summary lists the circumstances authorities must consider when deciding the amount. They include:

• the nature, gravity and duration of the infringement and the number of people affected;
• fines already imposed by other authorities for the same activity;
• the size, annual turnover and market share of the operator;
• financial gains or losses avoided;
• the degree of cooperation with the authorities;
• the operator's responsibility, taking into account technical and organisational measures it has put in place;
• how the authority learned of the infringement, including whether the operator reported it;
• whether the infringement was intentional or negligent, and the steps taken to mitigate harm.

The practical reading, and this is our interpretation rather than the text, is that documented governance, cooperation and prompt corrective action are the factors an employer can influence. Member States must also set rules on whether fines can apply to their own public authorities, and the summary notes that procedural safeguards, including effective judicial remedies, apply.

Who enforces in Ireland

Ireland has chosen a distributed model. The AI Office of Ireland's page on national competent authorities lists the bodies involved and says the Office coordinates. Among them, the Central Bank, the Data Protection Commission and the Competition and Consumer Protection Commission are described as market surveillance authorities for certain categories of AI, and the Health and Safety Authority for AI safety systems under certain product laws. The same page says the Workplace Relations Commission supervises the deployment and use of AI systems in the Irish labour market, which is directly relevant to HR use of AI.

The Department of Enterprise, Tourism and Employment announced on 17 June 2026 that the Government had approved publication of the Regulation of Artificial Intelligence Bill 2026. According to the Department, the Bill gives effect to the AI Act in Ireland, establishes the AI Office as an independent statutory body, and gives market surveillance authorities a graduated toolkit running from notices to prohibition and seizure to formal sanctions, including fines and prosecution, with independent adjudication and court oversight. The Department says it is a technical implementing measure that does not add to the obligations in the EU regulation. The announcement does not state penalty amounts. A separate Department page, last updated 27 May 2026, says non-compliance "could lead to fines" and likewise gives no figures. Legislation moves, so check the Oireachtas and Department pages for the Bill's current stage.

Dates: when can fines apply?

The Commission's page on the enforcement framework of the AI Act (last updated 24 August 2026) says the AI Office and national enforcement powers apply from 2 August 2026, and gives later dates for high-risk rules, 2 December 2027 for Annex III systems and 2 August 2028 for AI systems embedded in regulated products. Dates on the Commission page can change, so confirm the current position on that page before relying on any date.

What to do now: a practical approach

These steps are our suggestions, not legal requirements:

• List your AI tools, including those embedded in HR, payroll and finance software, and note who supplies each.
• Assign an owner for each tool. Governance that can be shown on paper is the sort of evidence the "responsibility" and "cooperation" factors point towards. Our guide to AI governance for managers covers this.
• Ask suppliers for their compliance documentation.
• Brief staff on what they may and may not use AI for.
• Take advice on anything that touches recruitment, worker monitoring or other sensitive uses.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Are the AI Act fines always the maximum amount?

No. The figures are upper limits. The Service Desk summary lists the factors authorities must weigh, including the gravity of the breach, cooperation and any steps to limit harm.

Do smaller businesses pay the same fines?

The summary says that for SMEs, including start-ups, each fine is capped at the lower of the percentage and the fixed amount, rather than the higher.

Who fines an Irish employer?

Ireland uses a distributed model of existing regulators, coordinated by the AI Office of Ireland. Which authority is relevant depends on the type of AI system and use. The Regulation of Artificial Intelligence Bill 2026 sets up the national framework, and its progress should be checked.

Can an employer be fined for staff using AI tools?

The pages we read do not address that scenario specifically. Deployer obligations are in the middle tier, so clear internal rules and training may be a sensible precaution (our suggestion).

Where can I check the current position?

Use the Commission's AI Act Service Desk and enforcement page, the AI Office of Ireland, and the Department of Enterprise, Tourism and Employment pages.

Penalties are the enforcement end of a regulation whose real work is done earlier, in knowing what AI you use and who is accountable for it.