HomeResearch

The fines, breaches and surveys behind AI governance

Ten items from regulators, official journals and the organisations that measure this. Each figure is quoted as the source states it, with a link to the original.

€35Mor 7% of turnover: the top AI Act fine tier

78%of AI users bring their own AI tools to work

97%of organisations with an AI-related breach lacked proper AI access controls

$4.99Mglobal average cost of a data breach in 2026

The law and its deadlines

The EU AI Act is in force, partly applied, and partly delayed. What applies now and what's coming.

1 Aug 2024The AI Act enters into forceRegulation (EU) 2024/1689
2 Feb 2025Bans and AI literacy applyProhibited practices, Art. 4 staff literacy
2 Aug 2025General-purpose AI model dutiesObligations on model providers
2 Aug 2026Transparency duties applyArt. 50: tell people they are dealing with AI
2 Dec 2027High-risk uses in Annex IIIHiring, credit, education. Was 2 Aug 2026
2 Aug 2028High-risk AI in regulated productsAnnex I. Was 2 Aug 2027

Filled dots have already applied (as of 3 November 2026). The two high-risk dates were moved by Regulation (EU) 2026/1744. Source.

Maximum fines, by tier

Prohibited AI practicesArticle 99(3)

€35M or 7% of worldwide turnover

Most other obligationsArticle 99(4), including deployer duties

€15M or 3%

Incorrect or misleading informationArticle 99(5), to authorities

€7.5M or 1%

Maximum fines under Article 99 of Regulation (EU) 2024/1689. For companies the higher amount applies; for SMEs, the lower. Source.

7%of worldwide annual turnover, or €35 million if higher, for prohibited AI practices

The EU AI Act sets fines above the GDPR ceiling

Article 99 of the AI Act sets three tiers: up to €35 million or 7% of total worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaches of most other obligations, and up to €7.5 million or 1% for giving authorities incorrect or misleading information. For companies, the higher amount applies; for SMEs, the lower.

Official Journal of the EU, Regulation (EU) 2024/168912 July 2024
Read the source (opens in a new tab)

2 Dec 2027when obligations for stand-alone high-risk AI systems now apply

The high-risk deadline moved. The rest of the AI Act did not.

Regulation (EU) 2026/1744, in force since 27 July 2026, moved the obligations for high-risk systems listed in Annex III (hiring, credit, education and similar uses) from 2 August 2026 to 2 December 2027, and for AI built into regulated products to 2 August 2028. The bans on prohibited practices and the AI literacy duty have applied since 2 February 2025.

Official Journal of the EU, Regulation (EU) 2026/17448 July 2026
Read the source (opens in a new tab)

Enforcement

Regulators acting on AI and on the controls AI systems depend on. One of these was overturned on appeal, and we say so.

€30.5MGDPR fine for Clearview AI from the Dutch data protection authority

Scraping faces for an AI database cost Clearview €30.5 million

The Dutch DPA found Clearview AI had built an illegal database of more than 30 billion photos of people, turned into a biometric code per face without their knowledge or consent. It added penalties of more than €5 million for continued non-compliance, and warned that Dutch organisations using the service would be breaking the law too.

Autoriteit Persoonsgegevens (Dutch DPA)3 September 2024
Read the source (opens in a new tab)

€15Mfine on OpenAI over ChatGPT, annulled by the Court of Rome in March 2026

Italy fined OpenAI over ChatGPT training data. A court annulled the fine.

Italy's Garante found that OpenAI had trained ChatGPT on personal data without first identifying a legal basis, had broken transparency duties and had not reported a March 2023 data breach. The Court of Rome upheld OpenAI's appeal in a judgment published on 18 March 2026, and the decision was withdrawn. The questions it asked, about legal basis and transparency, are the ones every deployer of AI on personal data has to answer.

Garante per la protezione dei dati personali20 December 2024
Read the source (opens in a new tab)

€5MGDPR fine on Luka Inc., the company behind the Replika chatbot

A companion chatbot with no legal basis and no age check

Italy's data protection authority found that until February 2023 Luka had not identified a legal basis for processing users' data and had no age verification, although it said minors were excluded. It also found the privacy policy inadequate and the current age checks still deficient.

European Data Protection Board, on the Garante decision of 10 April 202521 May 2025
Read the source (opens in a new tab)

$700,000HIPAA settlement after a phishing breach affecting 225,370 people

No accurate risk analysis, no access removal for leavers

HHS's Office for Civil Rights found Ambry Genetics had potentially failed to carry out an accurate and thorough risk analysis, to end access to health data when someone's employment ended, and to give each user a unique ID for tracking activity. Ambry agreed a two-year corrective action plan. Any AI system that touches patient data needs these same controls.

U.S. Department of Health and Human Services, Office for Civil RightsSeptember 2026
Read the source (opens in a new tab)

Shadow AI and breaches

What happens inside organisations when AI use runs ahead of the controls around it.

Bannedgenerative AI on Samsung devices and networks after a code upload

Samsung engineers uploaded sensitive code to ChatGPT

Bloomberg reported that Samsung told staff in a memo to stop using ChatGPT and similar tools on company computers, phones and internal networks, after finding that employees had uploaded sensitive code to the service. Data sent to an outside AI service is stored on servers the company does not control.

Bloomberg2 May 2023
Read the source (opens in a new tab)

78%of AI users bring their own AI tools to work

Your staff already use AI nobody approved

Microsoft and LinkedIn surveyed 31,000 people in 31 countries for the 2024 Work Trend Index. Three in four knowledge workers (75%) said they use AI at work, and 78% of AI users said they bring their own tools.

Microsoft and LinkedIn, 2024 Work Trend Index8 May 2024
Read the source (opens in a new tab)

97%of organisations with an AI-related breach lacked proper AI access controls

AI breaches happened where nobody controlled access

In IBM's 2025 study, one in five organisations (20%) had a breach linked to shadow AI, which added up to US$670K to the average breach cost. 63% of the breached organisations studied had no AI governance policy.

IBM, on its Cost of a Data Breach Report 202512 November 2025
Read the source (opens in a new tab)

$4.99Mglobal average cost of a data breach in 2026

The average breach now costs $4.99 million

IBM's 2026 Cost of a Data Breach Report puts the global average at US$4.99 million, a 12% increase over the previous year and a record high for the report.

IBMCost of a Data Breach Report 2026
Read the source (opens in a new tab)

What we take from it

Our reading. Most failures come from basic controls missing in new systems.

What we build in response

The basics fail first
No access control, no risk analysis, no record of who could see what. The HHS settlement and IBM's findings point at controls that existed long before AI.
Legal basis comes before the model
The Italian and Dutch cases turned on whether personal data could be used at all.
Bans don't hold
Most AI users bring their own tools. Controlled use with logging is easier to defend.
Deadlines move, duties don't
The AI Act's high-risk dates moved. GDPR, HIPAA and the Act's bans on prohibited practices apply today.

Sources checked on 3 November 2026. Where a figure at the source changes, the source is right and this page will be updated. Nothing here is legal advice.