AI Act fines for small businesses in Spain: tiers, AESIA and dates
November 9, 20267 min
Regulation (EU) 2024/1689, known as the AI Act, entered into force on 1 August 2024 and, under its Article 113, sets 2 August 2026 as the general date of application. The full text is on EUR-Lex. From that date, the penalty regime under Article 99 is applicable law in Spain.
The question a small business asks is not whether fines of 35 million euros exist. They do. The question is who they apply to, for what amount, and which authority handles the case.
The dates that are set
The timetable has shifted. Regulation (EU) 2026/1744 of 8 July 2026, known as the digital AI Omnibus, amends the AI Regulation and postpones obligations under Chapter III, concerning high-risk systems, as well as expanding support measures for small businesses, according to the summary from Iberley.
2 August 2026: general application of the Regulation, including the transparency obligations under Article 50, under the timetable set out in Article 113 of the Regulation itself. This covers notices that the user is interacting with an AI and the disclosure of generated or manipulated content.
2 December 2027: high-risk systems under Annex III, following the postponement under the Omnibus, as set out in this
Written with the help of artificial intelligence and reviewed by the Sofyer team.
Ready to start your project?
Describe what you need and get a fixed price in 2 minutes.
The postponement of high-risk obligations does not affect what matters most to a services-based small business: transparency, prohibited practices and the requirement for staff to know how to use the tool.
The three tiers of Article 99
Article 99 sets fines out in three tiers. The text of the article takes precedence over any summary.
1Prohibited practices (Art. 99.3): up to EUR 35,000,000 or, if the offender is a company, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher. This relates to Article 5: subliminal manipulation, social scoring, exploitation of vulnerabilities or biometric categorisation using sensitive data, among others.
2Non-compliance with other obligations (Art. 99.4): up to EUR 15,000,000 or 3% of worldwide turnover. This covers duties of operators and notified bodies that do not amount to prohibited practices.
3Inaccurate information to authorities (Art. 99.5): up to EUR 7,500,000 or 1%. This penalises providing inaccurate, incomplete or misleading information to notified bodies or competent national authorities in response to a request.
The 35-million tier is the least likely to affect an ordinary small business: it requires using a system prohibited under Article 5, not forgetting a notice on a chatbot.
How the amount is graded
Fines are not automatic. The same Article 99 requires the circumstances of each case to be taken into account: the nature, gravity and duration of the infringement, whether it was intentional or negligent, the measures taken to mitigate the damage, the size and turnover of the operator, and any previous penalties. It also requires that penalties be effective, proportionate and dissuasive. A company that can show an inventory, notices and a training record approaches that assessment from a different position than one with nothing in writing.
The rule in paragraph 6: the cap for a small business is the lower figure
Article 99 contains a specific rule for small businesses. Paragraph 6 states that, in the case of SMEs, including start-ups, each fine shall be up to the percentage or amount referred to in paragraphs 3, 4 and 5, whichever is lower. This is the reverse of the general rule, as set out in the text of the article.
The difference is substantial. For a large company, the higher of the fixed amount and the percentage applies. For a small business, the lower one applies. With turnover of 800,000 euros, 7% comes to 56,000 euros, 3% to 24,000 and 1% to 8,000: these are the relevant caps, not the millions.
In addition, paragraph 1 of Article 99 requires that, in setting penalties, authorities take into account the interests of SMEs, including start-ups, and their economic viability. This is not an exemption. It is a grading criterion that the case file must justify.
AESIA is not the only authority. The division of market surveillance set out in Spanish law can be summarised as follows, according to this analysis of the division of powers:
AESIA: market surveillance in general, including systems subject to the transparency obligations under Article 50, and single point of contact.
AEPD: biometrics, migration and borders, as well as matters linked to personal data, where several prohibited practices are concentrated.
CGPJ: use of AI in the justice system.
Central Electoral Board: electoral processes.
Sectoral authorities: Bank of Spain, CNMV and the Directorate-General for Insurance within their respective areas.
For a law firm, a clinic or a shop using a chatbot or generating content with AI, the likely point of contact is AESIA.
The Spanish AI governance bill
The Regulation is directly applicable, but the penalty procedure and the division of authorities are set out in detail by national law. The timeline is as follows:
11 March 2025: the Council of Ministers approves the Preliminary Draft Law on the Good Use and Governance of Artificial Intelligence, which develops the system of infringements and penalties in line with the Regulation, according to Cuatrecasas.
26 May 2026: the Council of Ministers approves the draft bill, with fines of up to 35 million euros for very serious infringements linked to prohibited practices and up to 15 million euros or 3% for other very serious high-risk infringements, according to the published information on the agreement.
Parliamentary procedure: Organic Law Bill 121/000096 designates AESIA as the market surveillance authority for certain systems and grants penalty powers to the surveillance authorities.
Scale of infringements: prohibited practices up to 35 million euros or 7%; other very serious infringements up to 15 million euros or 3%; serious infringements up to 7.5 million euros or 1%; minor infringements up to 500,000 euros, according to the analysis of the organic law bill.
As of July 2026 the Spanish text had not been definitively approved or entered into force, according to this tracking report. It is worth checking the status of the procedure before treating any national figure as settled. What is already in force and enforceable is the European Regulation.
What a review of a small business looks at first
Most small businesses do not develop AI systems: they use them. That places the risk at three specific points.
Transparency under Article 50: notifying that a user is interacting with an AI and disclosing generated or manipulated content. This is the obligation applicable from August 2026 and the one that leaves a public trace on a website.
Staff training: Article 4 requires a sufficient level of AI literacy among those operating the systems on behalf of the company.
Documentary evidence: knowing which tools are used, for what purpose, with what data, and who is internally responsible. Without a record, there is no way to demonstrate due diligence in response to a request.
Sofyer addresses these three points at a fixed price. The AI Act Compliance Kit costs €890 + VAT as a one-off payment: a 20-minute questionnaire, a 6-document file in PDF (systems register, usage policy, training, notices, executive report and officer's certificate), an online course for the team with a certificate per person for Article 4, and a client dashboard. For the transparency side separately, the AI Seal costs €149 + VAT per year and includes a free Article 50 scan, ready-to-paste notices, a verified seal with a public verification page, and automatic monthly rechecking.
Order of work for the coming weeks
1Take stock: list every AI tool used by the company, who uses it and with what data.
2Rule out prohibited practices: review Article 5 of the Regulation. It is the only tier with a 35-million cap.
3Put up the Article 50 notices: chatbot, generated content, manipulated images or videos.
4Train the team and keep the certificate: the evidence is worth as much as the training itself.
5Document the internal officer: a name, in writing, with a date.
To commission the ready-made file instead of putting it together by hand, the starting point is the AI Act Compliance Kit.
