Administrative Fines on Union Institutions, Bodies, Offices and Agencies
Follow topic LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this topic. Contains: the overview, key law text, case law, enforcement and guidance for this topic. Everything links back to its source on overview.legal — legal information, not advice.This specific provision addresses a distinct category of administrative fines applicable exclusively to Union institutions, bodies, offices and agencies, which differs from fines applicable to private actors and requires separate treatment to capture the unique institutional context and procedures.
Overview
9 sources · Jul 23, 2026Legal Framework
Article 100 of the AI Act establishes a specialized administrative fine regime applicable exclusively to Union institutions, bodies, offices, and agencies. Unlike the tiered percentage-of-turnover model applied to commercial entities, this provision imposes a fixed monetary cap on penalties—generally set at 1,500,000 EUR—recognizing the public mandate and non-profit structure of EU bodies. The European Data Protection Supervisor (EDPS) acts as the competent market surveillance authority for these entities. This framework ensures that EU bodies are held to the same substantive compliance standards as private actors but under a penalty structure suited to their institutional context.
Key Developments
Enforcement under the AI Act is nascent, but existing data protection jurisprudence informs how the EDPS will exercise its fining powers. The CJEU ruling in Rynes established a broad interpretation of personal data, confirming that visual recordings fall within the regulatory scope when identification is possible. This expansive definition triggers strict compliance duties for EU institutions deploying AI systems involving biometric or visual data. Furthermore, national enforcement trends provide a proxy for EDPS severity assessments. The Danish DPA's actions against IDdesign (€13,450) and Taxa 4x35 (€160,000) demonstrate that violations of core principles, particularly data minimization, attract substantial penalties. The EDPS will likely apply similar proportionality metrics when assessing institutional failures under Article 100.
Practical Guidance
- Ensure all AI systems processing visual or biometric data implement strict data minimization protocols, as established in Rynes and enforced in the Taxa 4x35 decision.
- Establish robust mechanisms for data subject access requests, aligning internal procedures with the standards articulated in EDPB Guidelines 01/2022 to mitigate enforcement risk.
- Implement certification mechanisms where feasible, as outlined in EDPB Guidelines 1/2018, to demonstrate proactive compliance and accountability under the AI Act.
- Conduct regular internal audits of AI systems to verify that processing activities remain within the institutional mandate and do not exceed the strict necessity threshold required by EU supervisory authorities.