AI penalties, compared

What non-compliance costs in all 45 tracked jurisdictions, whether a fine of up to 7 percent of worldwide turnover or no AI-specific penalty at all.

The fine is rarely the whole story. Europe leads on headline numbers, but China's real deterrent is losing the right to operate, and the sharpest US exposure is private litigation with statutory damages. Read the enforcement column with the deadline calendar beside it, since a penalty only bites once the obligation is effective.

Jurisdiction	Status	Penalties and enforcement
China	In force	Enforcement runs through the CAC and sector authorities under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law. Sanctions include service suspension, takedowns, fines, and, after the Cybersecurity Law amendment in force since January 1, 2026, more immediate penalties for serious breaches. Labeling enforcement has run since November 2025; in cases published September 15, 2026 the CAC ordered a generative AI mini program offline for missing explicit and implicit labels and for skipping security assessment.
European Union	Phasing in	Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for most other breaches; up to EUR 7.5 million or 1% for supplying incorrect information. The higher figure applies, except that SMEs, including start-ups, face whichever is lower, as do small mid-cap companies for the EUR 15 million and EUR 7.5 million tiers.
South Korea	In force	Administrative fines up to KRW 30 million (about USD 21,000) for failures such as not disclosing AI use or not appointing a domestic representative. The act emphasizes post-market oversight over pre-market approval.
United Kingdom	No comprehensive law	No AI-specific penalty regime. Enforcement flows through each regulator's existing powers, for example data-protection fines imposed by the Information Commission of up to the higher of GBP 17.5 million or 4% of global turnover. Making or supplying a purported intimate image generator carries up to three years in prison.
United States	No comprehensive law	No AI-specific federal penalties. Exposure runs through the FTC Act, sector regulators, and civil-rights and consumer-protection statutes. 'AI washing' (overstating what a system does) is an active FTC enforcement theme. Under the TAKE IT DOWN Act, a platform that fails to remove a reported intimate image within 48 hours commits an unfair or deceptive practice; the FTC has taken complaints at TakeItDown.ftc.gov since enforcement began on May 19, 2026 and puts the civil penalty at up to $53,088 per violation. Publishing non-consensual intimate deepfakes carries up to two years in prison, three if the victim is a minor.
Australia	No comprehensive law	No AI-specific penalty regime. Exposure runs through the Privacy Act, Australian Consumer Law, the Online Safety Act, and sectoral statutes, and the 2024 deepfake sexual material offenses carry prison terms of up to seven years.
Brazil	Proposed	The bill proposes administrative penalties and a civil-liability regime; specifics depend on the final enacted text. Criminal law already punishes AI-simulated child sexual abuse material and raises penalties for psychological violence against women committed with AI.
Canada	Lapsed / failed	No federal AI-specific penalties for developers or deployers. Privacy regulators and provincial statutes provide the enforcement backstop. Since July 18, 2026 the Criminal Code's intimate-image offense covers AI-made depictions of identifiable people. Bill C-34 would let a new Digital Safety Commission penalize chatbot and social media services that fail to comply.
Council of Europe	Proposed	No direct penalties; obligations are implemented and enforced through each party's national legal system.
Japan	In force	No penalties; the government relies on guidance, advice, and cooperation duties.
Mexico	No comprehensive law	Data protection sanctions through the reconstituted privacy authority. IMPI can fine breaches of the copyright law's rules on the use of a performer's image and voice, AI outputs included, and on AI impersonation of performances, when committed for direct or indirect profit. The reform pending in the Senate would set four to eight years in prison and fines of 400 to 1,000 UMA days for sharing AI-generated intimate content of an identifiable person without consent.
Peru	In force	Enforcement through existing consumer protection, competition, and data protection regimes coordinated under the regulation, rather than a standalone AI fine schedule. Law 32314 adds criminal penalties when AI is used to commit crimes, including one to three years in prison for defamation through AI deepfakes and four to eight years for aggravated fraud by AI voice or image manipulation.
Saudi Arabia	No comprehensive law	PDPL sanctions for data violations; supervisory and procurement consequences for departing from SDAIA expectations. No AI-specific fine schedule yet.
Switzerland	Proposed	No AI-specific penalties. FADP and sectoral enforcement apply, and FINMA supervision reaches AI in financial services.
Taiwan	In force	None under the Basic Act itself. Enforcement will come through the sectoral statutes it directs regulators to adapt.
UAE	No comprehensive law	Regulatory enforcement by zone and sector: DIFC Commissioner action, central bank supervisory measures, and PDPL sanctions, rather than a single AI fine schedule.
Vietnam	In force	Administrative enforcement through the Ministry of Science and Technology, including registration refusal, suspension orders, and orders against non-compliant systems. Systems already operating before March 1, 2026 have until March 1, 2027 to comply, or September 1, 2027 in healthcare, education, and finance; listed high-risk systems running before August 15, 2026 follow the same dates under Decision 33/2026.
Argentina	No comprehensive law	Data protection enforcement through the AAIP. No AI-specific penalties.
Chile	Proposed	None AI-specific until the bill passes.
Colombia	Proposed	Data protection enforcement through the SIC. Law 2502 of 2025 raises the criminal fine for impersonation using AI by up to one third. As proposed for first debate, PL 025/2026C would set fines of up to 500 monthly minimum wages for minor infractions, 1,500 or 100% of the economic benefit for serious ones, and 3,000 or 150% of the benefit, with suspension or closure of the system, for the most serious.
Egypt	No comprehensive law	Data-protection sanctions under Law 151/2020. No AI-specific penalties.
Hong Kong	No comprehensive law	PDPO enforcement for data-protection breaches; supervisory action for regulated financial institutions.
India	No comprehensive law	No AI-specific penalty regime; enforcement runs through IT law and data-protection law.
Indonesia	Proposed	UU PDP administrative sanctions and, for serious violations, criminal provisions. No AI-specific penalties yet.
Israel	No comprehensive law	No AI-specific penalties. Privacy Protection Authority enforcement and sectoral sanctions apply on their ordinary terms.
Kenya	Proposed	Data Protection Act enforcement applies now; the bill as published proposes fines of up to five million shillings, prison terms of up to two years, or both.
Malaysia	Proposed	None for the guidelines. PDPA enforcement applies to data-protection breaches.
New Zealand	No comprehensive law	No AI-specific penalties; enforcement runs through the Privacy Act and general statutes.
Nigeria	Proposed	NDPA sanctions apply now. The pending bill would add NITDA enforcement orders and fines of up to 10 million naira or 2 percent of annual Nigerian revenue, whichever is higher.
Singapore	No comprehensive law	No general AI penalty regime; enforcement is through the Personal Data Protection Act and sector regulators. Deepfake offenses carry fines and prison terms of up to two years.
South Africa	No comprehensive law	POPIA enforcement by the Information Regulator, including fines and, for some offenses, criminal liability.
Spain	Phasing in	The AI Act caps fines at EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other breaches, and EUR 7.5 million or 1% for supplying incorrect information. Spanish authorities have no national procedure to impose them, because the governance bill lapsed on October 6, 2026 before enactment. As introduced, that bill would have capped fines at EUR 35 million or 7% for prohibited practices, EUR 15 million or 3% for other very serious infringements, EUR 7.5 million or 1% for serious ones, and EUR 500,000 or 0.5% for minor ones, with warnings instead of fines for public bodies. The lapsed minors bill would have added prison terms for spreading sexual or degrading deepfakes.
Thailand	Proposed	PDPA penalties apply now, including administrative fines. The draft AI Act would add strict and joint liability and powers to suspend services, order recalls, and block AI systems; none of it is in force.
Turkey	Proposed	KVKK administrative fines and cybersecurity sanctions apply. No AI-specific penalties yet.
California	Partially in force	Vary by statute. The AI Transparency Act carries a $5,000 per-violation civil penalty, each day a separate violation, and SB 1000 added, until January 1, 2029, a $50,000 per-violation penalty for falsely representing that a system is designed primarily as assistive technology; the frontier act is enforced by the Attorney General. AB 1609 carries up to $5,000 for a first violation and $10,000 for each later one; SB 947, AB 1331, and AB 1883 up to $500 per violation; health-care AI violations run through the Medical Board and licensing boards. The CCPA rules on automated decisionmaking technology are enforced by the California Privacy Protection Agency and the attorney general.
Colorado	Phasing in	Up to $20,000 per violation of the ADMT law; Attorney General enforcement; no private right of action. Violations of the chatbot safety law are deceptive trade practices under the Colorado Consumer Protection Act. Under the April 27 court order, the attorney general cannot open enforcement or investigations under the ADMT law for conduct through 14 days after the court rules on xAI's preliminary-injunction motion.
Connecticut	Partially in force	Violations of the employment-tool rules are unfair trade practices enforced only by the attorney general, who may allow 60 days to cure violations through 2027. There is no private right of action.
Illinois	In force	BIPA allows statutory damages per violation through a private right of action; Human Rights Act violations are enforced by the Illinois Department of Human Rights. The attorney general enforces the AI Safety Measures Act, with no private right of action. The Department of Financial and Professional Regulation can fine up to $10,000 per violation of the AI therapy ban.
Montana	In force	The Right to Compute Act carries no penalties; government restrictions that fail its test can be challenged in court. HB 513 adds civil liability for unauthorized digital replicas. The attorney general can seek injunctions, civil penalties, and restitution from AI providers under the consumer protection and data privacy laws, as in its October 2026 suit against OpenAI.
New York	Partially in force	Local Law 144 carries civil penalties per violation. The RAISE Act, once in effect, carries penalties of up to $1 million for a first violation and $3 million for later ones, plus $1,000 a day for missing disclosure filings, enforced by the attorney general and the Department of Financial Services. AI companion violations carry up to $15,000 a day. Synthetic performer violations carry $1,000 for a first offense and $5,000 for each later one. Algorithmic pricing disclosure violations carry up to $1,000 each.
Tennessee	In force	Class A misdemeanor plus civil liability under the ELVIS Act; Consumer Protection Act remedies, private suits, and a $5,000 civil penalty per violation under SB 1580; a Class C misdemeanor and candidate damages for undisclosed political deepfakes; civil suits and a criminal offense for intimate deepfakes disclosed without consent.
Texas	In force	Curable violations $10,000 to $12,000; uncurable violations $80,000 to $200,000; $2,000 to $40,000 per day for continuing violations. Attorney General enforcement; after a court finding and an Attorney General referral, licensing agencies may add sanctions of up to $100,000. No private right of action.
Utah	In force	Administrative fines of up to $2,500 per violation, enforced by the Utah Division of Consumer Protection.
Virginia	Lapsed / failed	None AI-specific; VCDPA enforcement by the Attorney General.
Washington	Partially in force	MHMD violations are enforceable by the Attorney General and through private suits under the Consumer Protection Act.