Aug 3, 2026 · CloudMount editorial
The EU’s Latest Fines Send a Clear Message: Compliance Is No Longer Optional
EU regulators are turning promises into penalties. From GDPR security failures to DSA, DMA and incoming AI Act enforcement, the latest fines show why Irish businesses need provable, practical compliance now.
Read the enforcement signal, not just the headline
Large regulatory penalties attract attention, but a headline rarely explains what another business should change. The useful questions concern the obligation involved, the evidence examined and the weaknesses that allowed a problem to persist.
For Irish business leaders, the practical lesson is not that every mistake attracts a maximum fine. It is that policies need supporting evidence: decisions, assigned responsibilities, security measures and records showing that controls actually operate. Different EU laws regulate different activities, so their penalty figures should not be treated as interchangeable.
GDPR: two ceilings, with circumstances determining the outcome
Article 83 of the GDPR establishes two principal administrative fine tiers. Certain infringements can attract up to €10 million or, for an undertaking, 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. Other infringements, including breaches of basic processing principles and data subject rights, carry ceilings of €20 million or 4%, whichever is higher.
These are legal maximums, not predictions. Relevant considerations include the nature, gravity and duration of the infringement, intent or negligence, mitigation, previous infringements and cooperation. Supervisory authorities also have corrective powers, including orders to bring processing into compliance and restrictions or bans on processing.
DSA and DMA: different rules for different businesses
The Digital Services Act concerns intermediary services, with obligations varying by service and size. Article 52 provides a maximum of 6% of worldwide annual turnover in the preceding financial year for failures to comply with obligations under the Regulation.
The Digital Markets Act targets designated gatekeepers, not every business using digital tools. Article 30 allows Commission fines of up to 10% of worldwide turnover in the preceding financial year, rising to 20% for specified repeat infringements. Neither framework means that an ordinary Irish SME automatically faces gatekeeper or very-large-platform obligations.
AI Act penalties require equally careful reading
Under Article 99 of the AI Act, prohibited AI practices can attract fines up to €35 million or 7% of worldwide annual turnover. Specified other infringements carry ceilings of €15 million or 3%; supplying incorrect, incomplete or misleading information to relevant authorities can attract up to €7.5 million or 1%.
For undertakings, the higher applicable ceiling generally applies, but Article 99 provides a lower-of-the-two rule for SMEs, including start-ups. General-purpose AI model providers have a separate Commission enforcement framework under Article 101. Application is phased, so assess the relevant provision and timing rather than assuming every obligation applies together.
Build evidence before it is requested
Start with a register of processing activities and AI uses, identify accountable owners and record the legal reasoning behind important decisions. Check access permissions, supplier arrangements, retention rules and incident escalation. Where a data protection impact assessment is required, complete it before the proposed processing begins.
Then test whether practice matches the paperwork. Can staff explain where customer information goes? Can management retrieve an approval record? Can a supplier change trigger review? Organisations must be able to demonstrate compliance, not merely assert it.
Sources and further reading
General information only, not legal advice. Regulatory obligations depend on your role, context and the provisions in force.
Want to talk about your compliance?
Book a review