How much can my company be fined under eIDAS 2.0?
eIDAS 2.0 carries penalties of up to Per member state. This page breaks down every fine tier by article, explains who is at risk, and shows live enforcement examples.
How eIDAS 2.0 penalties work
eIDAS 2.0 penalties for trust service providers are set at national level. Supervisory bodies in each Member State designate the applicable sanctions for non-compliant trust service providers, including withdrawal of qualified status. Relying parties who refuse valid EU Digital Identity Wallets may face separate sector-specific penalties.
Fine tiers by article
Trust service provider violations — qualified status withdrawal and national fines
Per member state (effective, proportionate, dissuasive)
Applies to:
- Qualified trust service providers failing conformity assessment
- Providing misleading trust marks or certification
- Failure to notify supervisory body of security incidents
- Refusal to accept valid EU Digital Identity Wallet (relying parties in designated sectors)
Stacked exposure with other EU regulations
eIDAS 2.0 violations involving personal data in digital identity services can also engage GDPR penalties. Relying parties in regulated sectors (banking, healthcare) may face sector-specific fines on top of eIDAS penalties.
Calculate your stacked fine exposure →Frequently asked questions
What are the eIDAS 2.0 penalties?
eIDAS 2.0 penalties for trust service providers are determined by Member State supervisory bodies. There is no EU-wide fine ceiling in the Regulation; national authorities can impose sanctions up to and including withdrawal of qualified trust service provider status.
What is your stacked fine exposure across all EU regulations?
Calculate your combined risk across eIDAS 2.0, GDPR, NIS2, AI Act, DORA, and more — free, no signup.
Open fine risk calculator — freeFor informational purposes only. This is not legal advice — consult qualified legal counsel for advice specific to your situation.
Last updated: