Fourth study on the EU digital single market for The Competition System. The first mapped what the 34 instruments say, the second who enforces them, the third where their operative rules are actually written. This one asks what happens when they are broken.
**
Of all my rights as a European consumer, my favorite is the humblest, the right to know the price before I buy. A directive guarantees it, per unit, legible from the aisle, so that nobody discovers the cost at the till. So I went shopping in the one store nobody inspects, the legislator’s own. I walked the 34 instruments of the EU digital rulebook the way an inspector walks a market, stall by stall, checking every tag, the fine, the periodic penalty, the withdrawal, the management ban, the public naming. The shopkeeper failed his own inspection. One shelf carries two tags in different currencies. Several read “price fixed at the till, varies by country”. Six stalls display no tag at all. The most expensive item wears a tag stating a minimum, with the cashier invited to round up. And the most frequent tag in the market is not a price. It says, in small print, that the house may simply close your shop. The greengrocer gets fined for less. I wrote up the report all the same.
The anatomy of the 255
The 34 instruments of the EU digital rulebook contain 255 provisions that attach a consequence to non-compliance. Exhibit 1 clusters every form the corpus contains and gives each its share. One result belongs here because it corrects the received picture, that public discussion of EU digital enforcement is conducted almost entirely in fines. The corpus does not share that emphasis. The largest single category, roughly a third of all sanction provisions, consists of non-monetary consequences, the withdrawal of an authorization, the prohibition of a service, the removal or banning of managers, the public naming of the infringer. These are prices too, paid in capability rather than in money. For many firms they are the ruinous ones. A fine has a ceiling. Losing the license to operate does not.
The second structural fact is who sets the prices. Only 114 of the 255 provisions (44.7%) carry a consequence fixed in the EU text. For the other 141, more than half, the operative number or measure is written nationally, an inventory Exhibit 3 assembles in full. The EU digital rulebook is one rulebook with, at the limit, twenty-seven price lists. In what follows, I come back to those two findings in more detail.
From 20% of turnover to nothing at all
Where the texts do state numbers, the range is hard to defend as a system (the full tariff table is Exhibit 2). The DMA tops out at 20% of worldwide turnover for repeat offenders. MiCA prices market abuse in crypto at 15% of turnover, and that figure is a floor for the national maximum, not a ceiling. The AI Act caps at EUR 35 million or 7% for prohibited practices. The GDPR, once the reference point for regulatory fear, now sits mid-table at 4%. The Chips Act caps its crisis-stage fines at EUR 300,000, a rounding error for any firm the act applies to. And DORA, PSD2, the EECC and the entire telecom and media block state no number whatsoever.
Concretely: mislead consumers about a product and the fine floor is 4% of turnover in the Member States concerned, inserted by the Omnibus Directive. Mislead the market about a crypto-asset and the floor is 15% of total turnover. Deploy a prohibited AI system and the ceiling is 7% worldwide. Break NIS2, the act protecting hospitals and power grids, and the floor is 2%. Whatever theory of deterrence produced these numbers, it prices crypto misconduct at more than 7 times critical-infrastructure negligence, and both of those figures are floors, so the gap is the narrowest the texts allow.
The mechanisms diverge as much as the numbers. Four instruments write floors, a “maximum of at least”, so Member States may go higher; others write true ceilings Member States may not cross; the DSA does both at once, the Commission fining the largest platforms up to 6% directly while national fines for everyone else are capped at the same 6% (Exhibit 4 separates the two techniques, article by article, because the difference decides whether a firm can know its worst case from the text). Who holds the pen splits by the size of the target. Brussels fines the biggest, gatekeepers, the largest platforms, general-purpose AI, significant crypto issuers, crisis-stage chip suppliers. Everyone else answers to national authorities at nationally set levels. Who pockets the money is its own question, and the intuitive answer, Brussels keeps its fines and the capitals keep theirs, is wrong. Exhibit 5 follows the money provision by provision.
The prices also refuse to add up (Exhibit 6 runs the exercise). A large platform could be, at once, a GDPR controller (4%), a DSA VLOP (6%), a DMA gatekeeper (10%, then 20%), an AI Act deployer (up to 7%) and a Data Act holder (4% by reference). It does not have to be all of these; the point is that nothing in the texts changes when it is. Different infringements, separate ceilings, no aggregate cap anywhere in the corpus, and exactly 8 coordination clauses in 255 provisions address the risk of sanctioning the same conduct twice. At the other extreme, six instruments attach no penalty to anything, a finding I verified against each full text (Exhibit 7 names the six and asks which zeros are principled and which are accidents). And the penalty chapters carry deliberate discounts and personal sanctions that rarely reach the public debate, from the open-source exemption to a ten-year management ban (Exhibit 8 reads them as what they are, industrial policy by penalty design).
Proportional on paper
I read penalty chapters the way an economist reads prices, because that is what they are. A sanction is the price of breaking the law. And when the same infringement costs two competitors different amounts, the difference is not neutral; it advantages one of them.
The obvious objection is proportionality, and it deserves a serious answer. Every fining regime in the corpus instructs authorities to calibrate to gravity, duration, cooperation and the size of the offender, 24 separate criteria lists say so, and turnover-linked caps scale with the firm by construction. Calibration doctrine is supposed to neutralize the asymmetry. The texts themselves show why it does not. Fixed-euro floors do not scale down, MiCA’s EUR 5,000,000 minimum for legal persons and eIDAS2’s EUR 5,000,000 for natural persons are the same number for a bank and for a founder. Non-monetary consequences do not scale at all, an authorization withdrawal costs an incumbent one product line and costs a single-product entrant its existence. And the legislator does not trust proportionality either, which is why the AI Act caps SME fines at the lower of the two amounts (Article 99(6)) and the CRA exempts open-source stewards from fines outright, written discounts that would be redundant if calibration sufficed. Proportionality holds on paper, in the fine. It fails in the consequence.
One market, 27 checkouts
Prices steer conduct, and divergent prices steer location. When more than half of the rulebook’s penalty provisions leave the operative number to national law, the cost of the identical infringement varies by passport, and firms treat that variation as an input. It invites strategy. A group choosing where to establish, which entity signs which contract, which national authority will end up holding its file, is choosing its exposure, lawfully, the way it chooses a tax jurisdiction. The texts do not merely tolerate this; the floor technique, a “maximum of at least”, positively invites Member States to diverge upward, and nothing stops the purely national regimes from diverging downward into nuisance-level pricing.
There is, however, a counter-current, and it is the one genuinely encouraging finding of this audit. Measured generation by generation, the Member States are losing the power to price their own fines. Across three legislative waves, the share of sanction provisions left to national discretion has collapsed, while the share fixed in the EU text, and enforced at EU level, has grown from nothing to half (Exhibit 9 charts the whole trajectory). The stock of law in force still carries the old model, which is why 55% of today’s prices remain national. The flow runs the other way.
Monnet said that Europe would be forged in crises, and would be the sum of the solutions adopted for those crises. The sentence is usually quoted as consolation. It is better read as a method, Europe does not correct itself by grand design but by accretion, one file at a time, and the corrections are visible only to those who count. On the dimension this audit measures, the counting brings unexpected news. Each generation of the rulebook prices its rules more uniformly than the last, without a treaty change, without a communication, without anyone announcing a policy at all. The single market is being completed the way Monnet said it would be, quietly, and in the penalty chapters of all places. Next week, the last study of this series asks how far that market reaches, and who is inside it.
*
The audit below (about 3,500 words) assembles what the 34 penalty chapters never assemble themselves. The full tariff, every ceiling and every floor in one table (Exhibit 2). The 141 prices that vary by Member State (Exhibit 3), and the two drafting techniques that decide whether a firm can know its worst case from the text or only from twenty-seven implementing laws (Exhibit 4). Who fines whom, and the route the money takes, which is not the route one would guess (Exhibit 5). What the acts permit when several of them apply to the same firm, and the eight clauses that stand between that number and reality (Exhibit 6). The six instruments that sanction nothing (Exhibit 7). The discounts, and the provisions that ban managers rather than fine companies (Exhibit 8). The trajectory across 25 years of lawmaking (Exhibit 9). Every number is quoted from the operative articles.
