Deployers of AI agents are directly exposed to EU AI Act penalties, not only the providers who build them. The Act sets three tiers of fines: the highest for prohibited practices, a middle tier for breaching other obligations, including deployer and transparency duties, and a lower tier for giving authorities wrong or misleading information. Member states enforce them.
How does the penalty regime work?
The Act requires member states to lay down rules on penalties and other enforcement measures, which may include warnings and non-monetary measures. Penalties must be effective, proportionate and dissuasive, and must take account of the interests of SMEs and start-ups.
The Act then sets maximum fines in three tiers, in substance:
- Prohibited practices. The highest tier, for carrying out any of the practices the Act bans outright.
- Other obligations. A middle tier for breaching the obligations of operators, which expressly includes deployers, providers, importers, distributors and authorised representatives, and the transparency obligations to people.
- Information to authorities. A lower tier for supplying incorrect, incomplete or misleading information to authorities or notified bodies in reply to a request.
Each tier is expressed as a fixed amount or a share of total worldwide annual turnover. For most companies the higher of the two applies; for SMEs, including start-ups, the lower. We do not quote the amounts here; the structure matters more than the ceiling for anyone deciding what to fix first.
Fines for providers of general-purpose AI models are imposed at EU level rather than by member states, under a separate provision.
Who is exposed?
Every operator in the chain, by role. A deployer can be fined for failing deployer duties even if the provider did everything right. A provider can be fined for design failures even if the deployer used the system perfectly. Penalties follow the obligation that was breached.
Market surveillance authorities also have powers short of fines: requiring corrective action, restricting or prohibiting a system's use, and ordering its withdrawal. For a firm that relies on an agent in daily operations, an order to stop using it may hurt more than a fine. Our overview of what the EU AI Act requires deployers of AI agents to do lists the duties whose breach falls in the middle tier.
Which agent failures does the regime target?
Read against the duties, the tiers point at specific agent failures.
Top tier. An agent that manipulates people through techniques that bypass their judgement, or exploits vulnerability due to age, disability or financial situation, to their significant harm. For a deployer, the realistic risk is a collections, sales or retention agent that drifts into pressure tactics. Our answer to whether the EU AI Act bans any uses of AI agents lists the practices.
Middle tier, deployer duties. For a high-risk agent: using it outside the provider's instructions, having no competent oversight, failing to monitor, not keeping logs, not informing affected people or workers, skipping a required rights impact assessment.
Middle tier, transparency. Any agent that talks to people without telling them it is AI.
Lower tier. Giving a supervisor an incomplete answer when asked about an agent. A firm that cannot reconstruct what its agent did, and says something inaccurate as a result, risks this tier on top of whatever it was asked about.
What do authorities weigh when setting a fine?
The Act lists factors that authorities consider, in substance: the nature, gravity and duration of the breach and its consequences; how many people were affected and the harm done; fines already imposed for the same breach; the operator's size, turnover and market share; any gain made or loss avoided; cooperation with the authority; the operator's degree of responsibility given the technical and organisational measures it had in place; how the breach came to light; whether it was intentional or negligent; and what was done to reduce harm.
Several of these are within a deployer's control before anything goes wrong.
| Factor the authority weighs | Control | Evidence it leaves |
|---|---|---|
| Degree of responsibility given measures in place | Per-capability bounds, oversight and monitoring documented and running | Register, bound settings, oversight records |
| Duration of the breach | Monitoring that detects problems quickly; a tested stop control | Alert history; time from detection to stop |
| Number affected and harm | Limits on volume and value per capability | Bound settings; records of refusals at limit |
| How the breach became known | Internal detection and self-reporting route | Incident log with notification times |
| Cooperation | Records that can be produced quickly and accurately | Export tests; response times to requests |
| Actions to reduce harm | Remediation procedure for affected customers | Remediation records |
The pattern is consistent. The firm that can show its controls, detect quickly and produce accurate records is in a better position on almost every factor.
What will a supervisor ask after something goes wrong?
- What did the agent do, to whom, and for how long?
- What controls were in place, and why did they not stop it?
- When did you find out, and what did you do next?
- Who was accountable for this agent?
- Can you show us the records, complete and unaltered?
What does the penalty regime not settle?
It does not set the amounts that will be imposed in practice; it sets ceilings and leaves enforcement to member states. It does not replace penalties under GDPR, consumer law or sector rules, which may apply to the same facts. It does not protect a deployer that relied on a vendor's assurances; the vendor's general-purpose model duties, explained in what deployers inherit from general-purpose model obligations, do not cover yours. Dates for high-risk duties have been subject to proposed changes, as covered in our EU AI Act timeline for AI agent deployers, but the prohibitions already apply. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Some actions should be impossible for any agent, whatever a customer configures. In Pryme those are withheld at the platform floor: the action exists but is refused on purpose for every agent at every depth. Our explainer on what withheld means for an AI agent sets out how that differs from a customer's own limits.
Questions people ask
Can a deployer be fined if the provider's system was faulty?
The deployer is fined for its own breaches, such as using the system outside its instructions or failing to monitor it. A fault in the provider's design is the provider's breach. Both can be in breach at once.
Are SMEs fined less?
The Act caps SME fines at the lower of the two amounts for each tier, where larger firms face the higher. The duties themselves are the same.
Does a fine require harm to have occurred?
No. Breaching an obligation can be penalised without proof of harm, though the harm done is one of the factors in setting the amount.