Penalty CapsEU DSA

Digital Services Act penalties and fines

The DSA sets EU-wide maximum penalty caps, but the enforcing authority depends on the service and obligation: national Digital Services Coordinators enforce within their competence, while the Commission has direct enforcement powers for very large online platforms and very large online search engines.

Use this page to separate the 6% substantive fine cap, the 1% procedural fine cap, and the 5% daily periodic penalty-payment cap before estimating enforcement exposure.

Author
Sorena AI
Published
May 9, 2026
Updated
May 9, 2026
Sections
5

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated May 9, 2026
Overview

The Digital Services Act does not create one fixed fine amount for every violation. It sets maximum caps and assigns enforcement powers between Member State authorities and the European Commission. For planning, the useful first split is whether the issue is an ordinary intermediary-service matter handled by national competent authorities, or a VLOP/VLOSE matter where the Commission may investigate, adopt non-compliance decisions, impose fines, and impose periodic penalty payments.

Section 1

DSA fine caps to use in penalty exposure planning

For failures to comply with obligations laid down in the DSA, Member States must ensure that the maximum fine is 6% of the annual worldwide turnover of the provider of intermediary services concerned in the preceding financial year. The Commission uses the same 6% ceiling when it imposes fines on a provider of a very large online platform or very large online search engine for infringing the DSA, failing to comply with interim measures, or failing to comply with legally binding commitments.

A separate 1% ceiling applies to procedural failures such as supplying incorrect, incomplete, or misleading information, failing to reply or rectify information, or refusing to submit to an inspection. Under the Commission regime, the 1% cap is based on total annual income or worldwide turnover in the preceding financial year, depending on the addressee.

  • Substantive DSA obligation breach: maximum fine cap of 6% of annual worldwide turnover.
  • Incorrect, incomplete, or misleading information, non-reply, non-rectification, or refusal to submit to inspection: maximum fine cap of 1% of annual income or worldwide turnover.
  • Fine amount is not automatic; the DSA points to factors such as nature, gravity, duration, and recurrence of the infringement.
  • Do not use case-specific euro amounts unless they come from a published enforcement decision for the specific provider and facts.
Section 2

Who can enforce the Digital Services Act?

Member States designate competent authorities and a Digital Services Coordinator. The Digital Services Coordinator is responsible for all matters relating to DSA supervision and enforcement in that Member State unless specific tasks are assigned to another competent authority; it remains responsible for national coordination.

Digital Services Coordinators are, in principle, competent to supervise and enforce compliance by providers of intermediary services established in their territory. The Commission has exclusive competence to supervise, enforce, and monitor VLOP and VLOSE compliance with the enhanced due diligence obligations addressing systemic risks, while the Commission and national authorities share competence for other DSA obligations imposed on VLOPs and VLOSEs.

  • Use the provider's establishment and service type to identify the likely national authority path.
  • Escalate VLOP or VLOSE enhanced due diligence issues to the Commission enforcement track.
  • Keep the Digital Services Coordinator route visible for complaints, national investigations, inspection powers, and national penalty procedures.
  • For VLOP/VLOSE matters, record whether the issue is an enhanced due diligence obligation or another DSA obligation because the competence split can differ.
Section 3

Commission enforcement process for VLOPs and VLOSEs

For very large online platforms and very large online search engines, the Commission may investigate suspected non-compliance through requests for information, interviews, inspections, and access to data or algorithms. If suspicion remains after investigatory steps, the Commission may open proceedings.

Before adopting a non-compliance decision, a fine, or a periodic penalty payment, the Commission must give the provider or other addressee the opportunity to be heard on its preliminary findings and intended measures. If the Commission establishes a breach, it can order measures to address the breach and can impose fines within the DSA caps.

  • Evidence to keep: request-for-information responses, inspection readiness records, data-access logs, interview records, and legal review of response completeness.
  • Hearing rights matter: preserve the preliminary findings, response deadlines, submitted observations, and final decision record.
  • For non-compliance decisions, track the ordered remedy, deadline, owner, implementation evidence, and any follow-up requests.
  • Commission decisions imposing fines or periodic penalty payments can be reviewed by EU courts.
Section 4

Periodic penalty payments and last-resort enforcement measures

Periodic penalty payments are different from fines. They are daily pressure payments used to compel compliance with specified obligations, such as supplying correct and complete information, submitting to an inspection, complying with interim measures, complying with legally binding commitments, or complying with a Commission non-compliance decision.

The DSA cap for periodic penalty payments is 5% of average daily worldwide turnover or income under Member State penalty rules. For Commission VLOP/VLOSE enforcement, Article 76 caps periodic penalty payments at 5% of average daily income or worldwide annual turnover in the preceding financial year per day, calculated from the date appointed by the decision. The Commission enforcement page also describes temporary service restriction as a last-resort route when serious conditions are met.

  • Do not combine periodic penalty payments with ordinary fines as if they are the same sanction.
  • For each daily penalty exposure, record the decision date, date from which calculation starts, compelled act, and proof of satisfaction.
  • For information requests and inspections, response completeness and timeliness are separate enforcement risks from the underlying DSA obligation.
  • Treat access restriction as exceptional and procedure-heavy, not as a normal monetary penalty.
Section 5

Records to maintain before a DSA enforcement question arrives

A useful DSA penalty record does not estimate a fine in isolation. It ties the possible sanction to the authority, service classification, obligation, investigation step, and evidence proving response quality.

The record should be short enough for legal, trust and safety, product, and operations teams to maintain, but specific enough to distinguish a 6% substantive breach risk from a 1% procedural risk or a 5% daily periodic penalty-payment risk.

What is the highest DSA fine cap for failing to comply with an obligation?

The DSA uses a 6% cap for substantive failures to comply with obligations: Member State rules must allow maximum fines up to 6% of annual worldwide turnover, and the Commission may fine VLOP or VLOSE providers up to 6% of total worldwide annual turnover in the preceding financial year for the Article 74 categories.

What DSA fine cap applies to incorrect information or refusal to submit to inspection?

The DSA uses a 1% cap for procedural failures such as incorrect, incomplete, or misleading information, failure to reply or rectify, and refusal to submit to inspection. The Commission version of this cap applies to total annual income or worldwide turnover in the preceding financial year.

Who enforces DSA fines: the Commission or Digital Services Coordinators?

Both can be relevant. Digital Services Coordinators and other national competent authorities enforce providers within their competence. The Commission has direct VLOP/VLOSE enforcement powers, including exclusive competence for enhanced due diligence obligations addressing systemic risks and shared competence with national authorities for other VLOP/VLOSE obligations.

  • Service classification: intermediary service, hosting service, online platform, VLOP, or VLOSE.
  • Authority path: Digital Services Coordinator or other national competent authority, Commission, or shared competence.
  • Obligation involved: DSA obligation, interim measure, legally binding commitment, information request, inspection, access-to-file condition, or remedial decision.
  • Cap category: 6% substantive fine, 1% procedural fine, or 5% daily periodic penalty payment.
  • Mitigation evidence: timely response, completeness review, correction log, board or executive approvals, remedy plan, audit report where required, and proof of implementation.
Recommended next step

Build a DSA penalty record around authority, cap, and evidence

Sorena can help turn DSA enforcement questions into a source-cited record that separates national and Commission authority, 6% fines, 1% procedural fines, and 5% daily periodic penalty-payment exposure.

Primary sources

References and citations

Related guides

Explore more topics

DSA Ads and Recommender Systems: transparency duties, user choice, and evidence
A grounded DSA guide to ad labels, targeting restrictions, recommender parameter disclosure, non-profiling options for VLOPs and VLOSEs, ad repositories, and compliance evidence.
DSA Applicability Test: classify intermediary services, platforms, marketplaces, VLOPs and VLOSEs
A source-grounded EU Digital Services Act applicability test for classifying intermediary services, hosting services, online platforms, marketplaces, VLOPs and VLOSEs.
DSA Article 28 minors protection guide for online platforms
EU Digital Services Act guide to Article 28 minors protection: platform scope, child-safety measures, targeted ads limits, recommender controls, and grounded evidence.
DSA average monthly active recipients: what platforms must publish
A grounded FAQ on average monthly active recipients under the EU Digital Services Act, including publication, EU recipient scope, the 45 million VLOP/VLOSE threshold, and evidence records.
DSA Complaint and Dispute Workflows for Online Platforms
Build DSA complaint, appeal, statement-of-reasons, and out-of-court dispute workflows for online platform moderation decisions.
DSA crisis response for VLOPs and VLOSEs
EU Digital Services Act crisis response guide for VLOPs and VLOSEs: Article 36 Commission decisions, Article 48 crisis protocols, mitigation, governance, requests for information, and records.
DSA Dark Patterns: interface design checks for online platforms
Article 25 DSA guidance for reviewing online platform interfaces for deceptive, manipulative, or choice-distorting design patterns.
DSA Enforcement and Penalties in the EU
How Digital Services Act enforcement works: Commission and Digital Services Coordinator roles, VLOP and VLOSE investigations, fines, periodic penalty payments, and evidence readiness.
DSA illegal content notices: what must be included?
A grounded FAQ on EU Digital Services Act illegal-content notices: Article 16 notice elements, acknowledgement, decision notices, trusted flagger priority, statements of reasons, and records.
DSA Marketplace Trader Traceability FAQ
Answer to what EU Digital Services Act Article 30 requires online marketplaces to collect, verify, display, retain, and evidence for trader traceability.
DSA Marketplace Trader Traceability Guide
EU Digital Services Act guide for online marketplaces collecting, checking, displaying, storing, and evidencing trader traceability information.
DSA notice and action plus statements of reasons guide
A grounded Digital Services Act guide for notice intake, moderation decisions, statements of reasons, DSA Transparency Database submission, complaints, appeals, trusted flaggers, and records.
DSA Notice and Action Workflow for Hosting Services and Online Platforms
A grounded DSA notice-and-action workflow covering notice intake, completeness checks, trusted flaggers, decisions, user communications, statements of reasons, appeals, and records.
DSA recommender transparency FAQ: Article 27 and VLOP options
What EU Digital Services Act recommender transparency requires: main parameters, user options, VLOP/VLOSE non-profiling choices, and evidence to keep.
DSA researcher data access for VLOPs and VLOSEs
Article 40 DSA guide to vetted researcher data access for VLOPs and VLOSEs: DSC requests, eligibility checks, amendment grounds, confidentiality, security, and evidence records.
DSA service tier classifier for platforms, marketplaces, VLOPs and VLOSEs
Classify a digital service under the EU Digital Services Act as intermediary, hosting, online platform, marketplace, VLOP or VLOSE, with EU recipient-count evidence and obligation outputs.
DSA statement of reasons FAQ
When DSA statements of reasons are required, what they must contain, when online platforms submit them to the DSA Transparency Database, and what appeal records to keep.
DSA statement of reasons log workflow for online platforms
Build a DSA statement of reasons log for moderation decisions, Transparency Database submission, complaint links, retention, and QA controls.
DSA transparency report template fields and cadence
A source-grounded template outline for Digital Services Act transparency reports, covering applicable service tiers, reporting periods, CSV/XLSX format, retention, statement-of-reasons links, and required evidence tables.
DSA Transparency Reporting Obligations by Provider Tier
A grounded guide to EU Digital Services Act transparency reports, active-recipient publication, statements-of-reasons submissions, VLOP/VLOSE reports, templates, cadence, and evidence.
DSA VLOP and VLOSE Risk Assessments and Mitigation Guide
Grounded guide to Digital Services Act systemic risk assessments, mitigation measures, audits, transparency reports, data access, and governance evidence for VLOPs and VLOSEs.
DSA VLOP Audit Pack Workflow: Risk, Mitigation, Audit, and Transparency Records
Build a DSA VLOP or VLOSE audit pack covering Article 34 risk assessments, Article 35 mitigations, independent-audit evidence, transparency reports, data access, and compliance governance.
DSA VLOP Risk Assessment FAQ: Article 34, Mitigation, Audits
What VLOPs and VLOSEs must assess under the EU Digital Services Act, when to reassess, how Article 35 mitigation and annual audit evidence fit together, and what records to keep.
DSA vs DMA Platform Rules
Compare the EU Digital Services Act and Digital Markets Act by scope, designation thresholds, obligations, enforcement, evidence, and practical team ownership.
DSA vs GDPR: online-platform governance and personal-data obligations
Compare the EU Digital Services Act and EU GDPR by scope, ads, recommenders, minors, transparency, complaints, enforcement, and evidence.
DSA vs P2B Regulation: EU platform obligations compared
Compare the EU Digital Services Act with the Platform-to-Business Regulation for platform scope, business-user terms, content moderation, ranking transparency, complaints, enforcement, and evidence.
DSA vs Terrorist Content Online Regulation: notice-and-action vs removal orders
Compare DSA content-governance duties with the EU Terrorist Content Online Regulation removal-order workflow for scope, timing, evidence, authorities, and team ownership.
EU Digital Services Act checklist for platforms and hosting services
A grounded DSA checklist for classifying service tiers, notice-and-action, statements of reasons, complaints, transparency reports, ads, recommenders, trader traceability, VLOP/VLOSE duties, and evidence records.
EU Digital Services Act Compliance Guide
DSA compliance guide for intermediary services, hosting providers, online platforms, marketplaces, and VLOP/VLOSE teams: obligations, controls, and evidence to keep.
EU Digital Services Act FAQ: DSA scope, platform duties, VLOPs, reports, and penalties
Concise EU Digital Services Act FAQ covering intermediary-service scope, active-recipient thresholds, illegal-content notices, statements of reasons, trader traceability, recommender transparency, systemic-risk duties, reporting, penalties, and complaints.
EU Digital Services Act requirements by service tier
Overview of DSA obligations for intermediary services, hosting providers, online platforms, marketplaces, VLOPs and VLOSEs, including notices, complaints, ads, transparency reports, audits, data access and enforcement.
EU Digital Services Act service types and scope
Classify DSA service scope across mere conduit, caching, hosting, online platforms, marketplaces, online search engines, and VLOP/VLOSE threshold duties.
EU DSA deadlines and compliance calendar: application dates, reporting cycles, and VLOP clocks
Calendar view of grounded EU Digital Services Act dates: full application, user-number publication, VLOP/VLOSE designation clocks, statements of reasons, and transparency reporting cycles.
EU DSA Transparency Calendar: reporting, SoR database, AMAR updates
Build a DSA transparency calendar for annual reports, statement-of-reasons database submissions, active-recipient updates, and VLOP/VLOSE audit touchpoints.
EU DSA vs UK Online Safety Act: scope, duties, regulator, and evidence
Compare the EU Digital Services Act and UK Online Safety Act for platform scope, risk assessments, child protection, transparency, regulators, enforcement, and owners.