EU AI Act Penalties and Fines for AI Phone Agents, Tier by Tier

The EU AI Act fines a business running AI phone agents up to 35 million euros or 7% of worldwide turnover for banned practices, 15 million euros or 3% for duties such as the AI notice, and 7.5 million euros or 1% for misleading authorities. Our open-source AI voice agent platform, Dograh, lets you put that notice in the greeting.

Key Takeaways

• A missing AI notice on calls sits in the 15 million euros or 3% tier.
• Smaller firms pay the lower of the two figures on every tier.
• AI Act fines and GDPR fines are separate and never add together.

This post is part of our guide to the EU AI Act for voice agents, which covers the Article 50 notice and who carries it. Below, we set out the fine levels, the smaller-firm rule, which breaches a phone agent could hit and how Dograh keeps each call's evidence.

The three fine levels in plain words

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) sets the ceilings, and each Member State writes its own penalty rules under them. Those rules must be effective, proportionate and dissuasive, and they must take the interests of small businesses and start-ups into account. Article 99, as amended by the AI Omnibus, sets three levels.

The top level covers the banned practices. A breach can cost up to 35 million euros or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. The middle level, up to 15 million euros or 3%, covers a list of operator duties, including the provider and deployer duties and the transparency duties, among them the notice that tells callers they are talking to an AI. The lowest level, up to 7.5 million euros or 1%, applies to incorrect, incomplete or misleading information given to authorities or notified bodies in reply to a request.

The penalties chapter has applied since 2 August 2025, and the notice duty since 2 August 2026, as our EU AI Act timeline sets out. Fines on providers of general-purpose AI models sit in a separate article and land on model vendors, not on a business running calls.

Smaller firms pay the lower figure

For small and medium-sized enterprises, including start-ups, each fine is capped at whichever of the two figures is lower. That rule covers all three levels. The AI Omnibus extended the same lower-figure rule to small mid-cap enterprises, but only on the middle and lowest levels. A small mid-cap that uses a banned practice still faces the higher of 35 million euros or 7%.

The difference is large. Take, as an example, a firm with 20 million euros of annual turnover whose agent skipped the AI notice. As an SME, its fine is capped at 3% of turnover, at most 600,000 euros. If the same breach came from a firm treated as large, the cap would be the higher figure, 15 million euros. The cap is a ceiling, and the actual fine depends on the factors below.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Which breaches a phone agent could hit

A phone agent touches only a few parts of the Act, and each part maps to one level. The table below is our reading of how they line up, written as informed commentary.

The missing notice is the most likely breach for most phone agents, because it happens on every call that opens wrong. The banned practices carry the highest figure but need significant harm, and our post on prohibited practices for voice agents explains where scripts and emotion reading cross that line.

The high-risk row applies only to agents whose output decides access to credit, jobs or essential services, and our post on high-risk rules for voice agents covers those duties. AI literacy, in our reading, is not among the duties the penalty article lists. Each of these readings is general, so confirm your own position with counsel before you rely on it.

How an authority sets the amount

Within the ceiling, the authority weighs the facts of the case. Article 99 lists the gravity and duration of the breach, how many people were affected, earlier fines for the same conduct, the firm's size and market share, any gain made, cooperation, how the breach came to light, whether it was intentional or negligent, and what the firm did to reduce the harm.

For a phone agent, two of those factors grow with every call. A missing notice on a line taking thousands of calls a week affects thousands of people, and it keeps going until someone notices. Catching it in the first week and fixing it the same day weighs on both duration and mitigation.

National enforcement is still being set up. Cullen International found in April 2026 that only Denmark, Finland and Italy among 19 countries it benchmarked had a national AI law in place. By June 2026, the national implementation tracker run by the Future of Life Institute counted 9 Member States that had named both their market surveillance and notifying authorities.

AI Act fines and GDPR fines are separate

A call that breaks both laws can draw two separate fines, under two separate laws. The General Data Protection Regulation (GDPR) sets its own top level for the main breaches, up to 20 million euros or 4% of worldwide turnover, and data protection authorities enforce it.

Adding the two top percentages into one figure misreads both laws. The AI Act fine answers an AI Act breach, such as a missing notice, and the GDPR fine answers a data breach, such as recording calls with no lawful basis. Each regulator sets its own amount for its own breach. Our post on the GDPR and voice AI covers the data side.

Keep the evidence of every call

The best defense against the middle-level fine is a notice that plays the same way on every call, plus a record that shows it did. In Dograh, the notice goes in the Greeting Text on the Start Call node, which plays word for word. Allow Greeting Interruption is on by default, so switch it off and the caller's speech is held until the notice finishes.

Every call keeps its recording, transcript and full call trace, so you can show what a given caller heard. Built-in QA reads the transcript after each call, so add a check on a sample of calls that the notice was spoken. Self-hosted Dograh has no per-minute platform fee, but servers, model keys and phone minutes still cost money. Dograh Cloud charges a 1¢-a-minute platform fee.

Self-hosting changes where the call data sits and leaves your AI Act duties exactly where they were, so treat the notice and the records as the part that keeps you on the right side of the fines.