Home › Law library › Fines under the EU AI Act, DSA, DORA, NIS2, CRA and other digital laws
Fines under the EU AI Act, DSA, DORA, NIS2, CRA and other digital laws
How much each EU and UK digital, AI and cybersecurity law lets regulators fine, side by side. Fines are maximums: regulators set the actual amount case by case. Each row comes from the law's own page, where every fact links to its official source.
Short answers
- EU AI Act — the highest cap in EU digital law, up to EUR 35m or 7% of worldwide turnover for prohibited AI practices.
- Digital Services Act (DSA) — up to 6% of annual worldwide turnover.
- EU GDPR — up to EUR 20m or 4% of worldwide turnover, whichever is higher.
- Cyber Resilience Act (CRA) — up to EUR 15m or 2.5% of worldwide turnover for breaching the essential cybersecurity requirements.
- NIS2 — at least EUR 10m or 2% for essential entities and EUR 7m or 1.4% for important entities; national caps can be higher.
- DORA — no EU-wide fine amount for financial entities, because each Member State sets them; critical ICT providers face daily penalties of up to 1% of average daily worldwide turnover for up to six months.
- UK Online Safety Act — up to £18m or 10% of qualifying worldwide revenue, whichever is greater.
12 laws in 3 jurisdictions. Library last updated 11 October 2026. = confirmed by two independent sources, at least one official. Rows marked “Being verified” are still being confirmed and are not given as answers.
| Law | Jurisdiction | Maximum fine or penalty | Last verified |
|---|---|---|---|
| Cyber Resilience Act (CRA) | European Union | Up to EUR 15m or 2.5% of total worldwide annual turnover, whichever is higher, for breaching the essential cybersecurity requirements (Annex I) or manufacturer duties in Arts 13-14; up to EUR 10m or 2% for other listed duties (e.g. importers, distributors, notified bodies); up to EUR 5m or 1% for incorrect, incomplete or misleading information to authorities (Art 64). Member States set the rest of the penalty rules.✓ | 10 October 2026 |
| DORA | European Union | DORA sets no EU-wide fine amount for financial entities: each Member State lays down administrative penalties and remedial measures (Art 50) and may add criminal penalties (Art 52), so maximum fines depend on the country. For critical ICT third-party service providers, the Lead Overseer can impose daily periodic penalty payments of up to 1% of average daily worldwide turnover, for up to six months (Art 35(6)-(8)).✓ | 10 October 2026 |
| Digital Services Act (DSA) | European Union | Up to 6% of annual worldwide turnover.✓ | 10 October 2026 |
| EU AI Act | European Union | Up to EUR 35m or 7% of worldwide turnover for prohibited practices; EUR 15m or 3% for other obligations incl. high-risk and transparency; EUR 7.5m or 1% for misleading info (whichever higher; SMEs pay the lower).✓ | 10 October 2026 |
| EU Data Act | European Union | Set nationally; must be effective, proportionate and dissuasive (e.g. Ireland's draft: up to 4% of EU turnover). GDPR fines apply to personal-data breaches.✓ | 10 October 2026 |
| European Accessibility Act (EAA) | European Union | Set nationally (fines, product withdrawal, in some countries criminal sanctions); must be effective, proportionate and dissuasive.✓ | 10 October 2026 |
| NIS2 | European Union | Essential entities: maximum of at least EUR 10m or 2% of worldwide turnover; important entities: at least EUR 7m or 1.4% (whichever higher). National caps may be higher.✓ | 10 October 2026 |
| EU GDPR | European Union (EEA) | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ | 10 October 2026 |
| ePrivacy cookie rule | European Union (EEA) | Set nationally; must be effective, proportionate and dissuasive (varies by country).✓ | 10 October 2026 |
| UK GDPR / DPA 2018 | United Kingdom | Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher (lower tier £8.7m or 2%). PECR fines raised to the same level from 5 Feb 2026.✓ | 10 October 2026 |
| UK Online Safety Act | United Kingdom | Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (Sch 13 para 4). Ofcom can also impose daily penalties and, with a court order, business disruption measures requiring payment, advertising or internet access providers to stop working with a service or block it in the UK. Senior managers can face criminal liability for certain information and enforcement failures.✓ | 11 October 2026 |
| UK PSTI (connected products) | United Kingdom | Up to £10 million or 4% of qualifying worldwide revenue, whichever is greater, plus up to £20,000 per day for a continuing breach. OPSS can also issue compliance, stop and recall notices and seek forfeiture.✓ | 11 October 2026 |
See which of these laws apply to you with the Global Law Finder
Information only, not legal advice. Laws change; open the law page and its official source before relying on a row. Spotted an error? Email contact@