EU AI Act Article 12 Penalties: Fines for Non-Compliance Explained

The headline number attached to the EU AI Act is large: up to €35 million or 7% of global annual turnover. But that ceiling does not apply to every breach. Article 12 — the automatic logging obligation for high-risk AI systems — sits in a specific penalty tier, and understanding which one changes how you should think about your exposure.

This guide breaks down the fine structure, explains which tier Article 12 falls into, shows how the figure is actually calculated, and describes what regulators weigh when they assess whether your logging obligation has been met.

The three penalty tiers

The EU AI Act sets administrative fines in Article 99, structured into tiers according to the severity of the breach.

In each case the cap is whichever amount is higher — except for SMEs, including start-ups, where Article 99(6) applies the lower of the two figures to keep penalties proportionate to size. Member States can also use warnings and non-monetary measures (Article 99(1)).

Which tier does Article 12 fall into?

The middle tier: up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher.

Strictly, Article 99(4) does not list Article 12 itself. It lists the obligations of each operator, and a logging failure reaches you through whichever applies to you:

• —Providersbreach Article 16, which requires them to ensure their high-risk system meets the requirements of Chapter III, Section 2 — including Article 12's automatic logging capability.
• —Deployers breach Article 26, which requires them to keep the logs generated by the system for at least six months (Article 26(6)).

The same tier covers most of the operational requirements for high-risk AI — risk management, data governance, technical documentation, human oversight and logging. It is not the top tier reserved for prohibited practices, but it is the tier most high-risk operators are realistically exposed to, because logging is a continuous, every-transaction obligation that is easy to get wrong at scale.

How the figure is actually calculated

The “€15M or 3%” formula produces very different caps depending on company size — and on whether you qualify as an SME (broadly, fewer than 250 employees and turnover up to €50M or a balance sheet up to €43M).

These are maximums. The actual fine is set case by case using the factors below, and Article 99(1) requires it to be effective, proportionate and dissuasive.

What regulators actually assess

Article 99(7) lists the circumstances authorities must weigh when deciding whether to fine and how much. For a logging breach, the factors that tend to matter most are:

• —Nature, gravity and duration — whether logging was absent entirely, incomplete or merely imperfect, how long the gap lasted and how many people were affected.
• —Intentional or negligent character. A documented, good-faith logging programme with a minor gap is treated very differently from no logging at all.
• —Degree of responsibility, taking into account the technical and organisational measures you had in place.
• —Cooperation and mitigation — how you worked with the authority and what you did to limit harm.
• —How the breach became known — and in particular whether you notified it yourself.
• —Fines already imposed by other authorities for the same conduct.

This is why the quality of your audit trail matters as much as its existence. When something goes wrong, the question regulators ask is rarely only what the model did — it is whether you can produce a credible, tamper-evident record of what the system did and when. An audit trail that cannot answer that question is itself evidence of inadequate technical and organisational measures.

Who enforces it

Enforcement is handled by national market surveillance authorities designated by each EU Member State, coordinated at EU level through the AI Office and the European Artificial Intelligence Board. The body knocking on your door is a national regulator, applying the AI Act's harmonised penalty framework within its own procedural rules.

For companies operating across multiple Member States this matters: a high-risk system deployed EU-wide can attract attention from any national authority where it affects individuals.

The cost of getting logging wrong

For a high-risk AI operator, an Article 12 failure is not a paperwork fine. It is a middle-tier breach with a cap of at least €15 million for any company that is not an SME, rising to 3% of group turnover for large groups.

And unlike a one-off documentation error, a logging failure compounds. Article 12 covers the lifetime of the system, so a gap is not a single missed record — it is every decision the system made during the unlogged period, none of which you can later reconstruct or defend.

How to reduce your exposure

The mitigations map directly to the factors regulators weigh:

• —Log automatically and completely, so there is no gap to find.
• —Make logs tamper-evident, so the record is credible without your assurance.
• —Start early. A logging programme running well before the deadline demonstrates good faith and produces the clean historical trail that defends individual decisions.
• —Keep documentation consistent with the logging you actually run, so your Article 11 technical documentation and your Article 12 logs tell the same story.

Sovergate exists to remove this exposure: automatic capture, local PII scrubbing, cryptographic tamper-evidence, EU data residency and regulator-ready audit packs — installed in two lines of code.

Frequently asked questions