EU AI Act Compliance Checker: Risk Class and Fines
Classify your AI systems under Regulation (EU) 2024/1689 (Annex III High-Risk, GPAI models) and compute maximum statutory fine liability.
EU AI Act: classifying an AI system and its maximum fine
The tool classifies your use case under Regulation (EU) 2024/1689 (prohibited practice, Annex III high risk, general-purpose AI model, limited risk) and shows the fine ceiling: the higher of a fixed amount and a percentage of worldwide turnover. That ceiling ranges from €35 million or 7% for a prohibited practice to €15 million or 3% for other breaches.
Classification and ceilings applied
| Category | Cases offered | Ceiling |
|---|---|---|
| Prohibited practice (Art. 5) | social scoring, untargeted facial image scraping | €35m or 7% |
| High risk (Annex III) | recruitment, credit scoring, biometrics, education, critical infrastructure | €15m or 3% |
| GPAI model | box ticked; systemic risk above 1025 training FLOPs | €15m or 3% |
| Limited risk | chatbot, content generation, internal analytics | €15m or 3% |
The ceiling shown is the higher of the two amounts. The compliance score adds 25 points per ticked box: human oversight, data governance and logging, technical documentation, content marking.
Example
CV screening (high risk) in a company with €30m worldwide turnover: 3% is €900,000, less than €15m, so the tool shows €15,000,000. With three boxes out of four, the score is 75/100. A prohibited practice in a group with €800m turnover raises the ceiling to €56m (7%).
Limits
- For SMEs and start-ups the regulation uses the lower of the two amounts (Art. 99(6)), i.e. €900,000 in the example; the tool always applies the higher one.
- Internal analytics is usually minimal risk with no specific fine; the tool still applies the transparency ceiling.
- These are legal ceilings, not a likely fine, and a screening that is not legal advice.
Timeline
Prohibitions have applied since 2 February 2025, GPAI obligations since 2 August 2025, Article 50 transparency from 2 August 2026. The Digital Omnibus postponed Annex III high-risk rules to 2 December 2027 and Annex I to 2 August 2028; the timeline displayed in the tool reflects it.
Sources and dates: Regulation (EU) 2024/1689 on artificial intelligence, Arts. 5, 51, 99, 101 and 113; amending Regulation (EU) 2026/1744, published in the OJ on 24 July 2026, in force since 27 July 2026 (checked 14/10/2026).
Frequently Asked Questions
What is the maximum fine under the EU AI Act?
Up to €35 million or 7% of worldwide turnover for a prohibited practice, €15 million or 3% for other obligations (high risk, transparency, general-purpose models) and €7.5 million or 1% for supplying incorrect information to authorities. The higher amount applies, except for SMEs and start-ups, where the lower one does.
Is AI recruitment software high risk?
Yes: Annex III covers systems intended for recruitment, selection, filtering of applications and evaluation of candidates. They require risk management, data governance, logging, technical documentation and human oversight, among other things. Since the Digital Omnibus, these obligations apply from 2 December 2027.
When do the AI Act obligations apply?
Prohibited practices have been banned since 2 February 2025 and the rules for general-purpose AI models have applied since 2 August 2025. Transparency duties (chatbots, generated content) apply from 2 August 2026. Annex III high-risk rules follow on 2 December 2027 and high-risk AI embedded in regulated products on 2 August 2028.
When is a general-purpose AI model considered to pose systemic risk?
It is presumed to pose systemic risk when the cumulative compute used for its training exceeds 10²⁵ floating-point operations (Art. 51). Its provider must then assess and mitigate those risks, report serious incidents and ensure cybersecurity, on top of the obligations shared by all models.
Is this tool really free?
Yes, all tools on Kristools are 100% free and accessible without registration.
Is my data protected?
Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.