Agent · cyberresiliens-2024-2847-64

Cyberresiliensakten artikel 64: Penalties

Structural tree: the article's own paragraphs, verbatim.

CELEX 32024R2847 · 2026-08-18 · Weight 70 · minimal-risk

OpenOpen reading. No metering is planned for this class.

CyberresiliensaktenOfficial source

Inputs

• in_scopeThe article applies to the situationboolean
• punktParagraph of the articleenum (1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14)

Rule tree

1. If: alla(in_scope = true, punkt = 1)

   Paragraph 1 applies

   1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, without delay, notify the Commission of those rules and measures and shall notify it, without delay, of any subsequent amendment affecting them.

   Paragraph 1

2. If: alla(in_scope = true, punkt = 2)

   Paragraph 2 applies

   2. Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.

   Paragraph 2

3. If: alla(in_scope = true, punkt = 3)

   Paragraph 3 applies

   3. Non-compliance with the obligations set out in Articles 18 to 23, Article 28, Article 30(1) to (4), Article 31(1) to (4), Article 32(1), (2) and (3), Article 33(5), and Articles 39, 41, 47, 49 and 53 shall be subject to administrative fines of up to EUR 10 000 000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

   Paragraph 3

4. If: alla(in_scope = true, punkt = 4)

   Paragraph 4 applies

   4. The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request shall be subject to administrative fines of up to EUR 5 000 000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

   Paragraph 4

5. If: alla(in_scope = true, punkt = 5)

   Paragraph 5 applies

   5. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following:

   Paragraph 5

6. If: alla(in_scope = true, punkt = 6)

   Paragraph 6 applies

   (a)

   Paragraph 6

7. If: alla(in_scope = true, punkt = 7)

   Paragraph 7 applies

   the nature, gravity and duration of the infringement and of its consequences;

   Paragraph 7

8. If: alla(in_scope = true, punkt = 8)

   Paragraph 8 applies

   (b)

   Paragraph 8

9. If: alla(in_scope = true, punkt = 9)

   Paragraph 9 applies

   whether administrative fines have been already applied by the same or other market surveillance authorities to the same economic operator for a similar infringement;

   Paragraph 9

10. If: alla(in_scope = true, punkt = 10)

    Paragraph 10 applies

    (c)

    Paragraph 10

11. If: alla(in_scope = true, punkt = 11)

    Paragraph 11 applies

    the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the infringement.

    Paragraph 11

12. If: alla(in_scope = true, punkt = 12)

    Paragraph 12 applies

    6. Market surveillance authorities that apply administrative fines shall communicate that application to the market surveillance authorities of other Member States through the information and communication system referred to in Article 34 of Regulation (EU) 2019/1020.

    Paragraph 12

13. If: alla(in_scope = true, punkt = 13)

    Paragraph 13 applies

    7. Each Member State shall lay down rules on whether and to what extent administrative fines may be imposed on public authorities and public bodies established in that Member State.

    Paragraph 13

14. If: alla(in_scope = true, punkt = 14)

    Paragraph 14 applies

    8. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or other bodies according to the competences established at national level in those Member States. The application of such rules in those Member States shall have an equivalent effect.

    Paragraph 14

If no rule matches: The article is not stated to apply, or no paragraph is selected. The agent abstains rather than guesses.

The article text as read

1. 11. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, without delay, notify the Commission of those rules and measures and shall notify it, without delay, of any subsequent amendment affecting them.
2. 22. Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.
3. 33. Non-compliance with the obligations set out in Articles 18 to 23, Article 28, Article 30(1) to (4), Article 31(1) to (4), Article 32(1), (2) and (3), Article 33(5), and Articles 39, 41, 47, 49 and 53 shall be subject to administrative fines of up to EUR 10 000 000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.
4. 44. The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request shall be subject to administrative fines of up to EUR 5 000 000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.
5. 55. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following:
6. 6(a)
7. 7the nature, gravity and duration of the infringement and of its consequences;
8. 8(b)
9. 9whether administrative fines have been already applied by the same or other market surveillance authorities to the same economic operator for a similar infringement;
10. 10(c)
11. 11the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the infringement.
12. 126. Market surveillance authorities that apply administrative fines shall communicate that application to the market surveillance authorities of other Member States through the information and communication system referred to in Article 34 of Regulation (EU) 2019/1020.
13. 137. Each Member State shall lay down rules on whether and to what extent administrative fines may be imposed on public authorities and public bodies established in that Member State.
14. 148. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or other bodies according to the competences established at national level in those Member States. The application of such rules in those Member States shall have an equivalent effect.

No legal advice. Deterministisk regeluppslagning. Ingen juridisk rådgivning, inget efterlevnadsbeslut, ingen bedömning av ett enskilt ärende.

Citation: 32024R2847 art. 64, Penalties. ExploreWorld Legal, https://legal.exploreworldai.com/agent/cyberresiliens-2024-2847/artikel-64 (hämtad 2026-08-18, bevis sha256:124da528b0dc936a, bygge legal-2026-08-25).