The Cost of Non-Compliance
Compliance is no longer a soft legal concern. It is a financial, operational, and strategic risk surface that grows larger with every new EU regulation. These are real cases, real fines, and real consequences — and they are only the beginning.
7.1B+
Cumulative GDPR fines, 2018 to Jan 2026
84%
Of border-checked goods sent to the lab, found dangerous (2026)
4,671
Safety Gate alerts in 2025, the highest since 2003; top categories cosmetics (36%) and toys (16%)
3%
Max fine as % of worldwide turnover (CSDDD, Directive (EU) 2026/470)
Three layers of risk
Non-compliance creates compounding exposure across financial, operational, and strategic dimensions.
Financial Risk
- Regulatory fines up to 3% of global turnover (CSDDD, Art. 27)
- Product recall and remediation costs
- Criminal liability where Member States provide for it in national law
- Delayed product launches
- Lost revenue from blocked shipments
- Insurance and liability exposure
Market Access & Operational Risk
- Products blocked at customs via DPP Registry checks
- EU market entry denied or restricted
- Retailer and marketplace delisting
- Public procurement disqualification
- Inability to prove compliance on demand
- Supply chain friction and delays
Reputational & Strategic Risk
- Public enforcement actions (published by regulators)
- Loss of customer and partner trust
- ESG rating downgrades and investor concern
- Negative press and permanent public records
- Competitive disadvantage in circular economy
- Exclusion from sustainable supply chains
Enforcement is not hypothetical
These are real companies, real regulatory actions, and real financial consequences. Every case is source-backed.
Shein
French DGCCRF conducted an 11-month investigation finding Shein used deceptive commercial practices including misleading environmental sustainability claims and fake discounts.
Consequence: Largest greenwashing fine in EU to date. Direct preview of EmpCo Directive enforcement starting September 2026 — the same anti-greenwashing rules will apply to all companies making environmental claims.
Shein
Italian AGCM found Shein made unsubstantiated environmental claims about products being 'eco-friendly' and 'sustainable' without adequate evidence.
Consequence: Second EU country to fine Shein in the same year. Pattern: multiple member states enforcing simultaneously against the same company — a preview of coordinated EU enforcement.
TikTok
TikTok transferred European user data to China without adequate data protection safeguards, violating GDPR's cross-border transfer rules.
Consequence: Largest GDPR fine ever at the time of issuance. EU enforcement appetite continues to grow: DLA Piper's January 2026 survey puts cumulative GDPR fines at EUR 7.1 billion since May 2018, with the Irish DPC alone accounting for EUR 4.04 billion.
X (formerly Twitter)
First-ever DSA non-compliance decision. European Commission found X failed to meet transparency obligations, provided misleading information about its advertising repository, and restricted researcher data access.
Consequence: First DSA fine signals EU is now enforcing its newest digital regulations. Precedent: EU adopts regulation, then enforces it. The same trajectory will apply to ESPR, DPP, and product regulations.
Temu
The European Commission found that Temu failed to diligently identify, analyse and assess the systemic risks of illegal products being offered on its platform. In a mystery shopping exercise for the investigation, a very high share of the chargers tested failed basic safety tests, and a high share of the baby toys tested posed medium to high safety risks.
Consequence: Temu had until 28 August 2026 to submit an action plan, and failure to comply with the decision may lead to periodic penalty payments. Under the DSA, very large online platforms must assess and mitigate the systemic risks of their services, including the spread of illegal products.
AliExpress
The European Commission found that AliExpress failed to diligently assess and mitigate the risks of illegal, unsafe or counterfeit products being sold on its platform. Its detection system did not work properly, illegal products including unsafe toys and dangerous cosmetics stayed online for weeks even after detection, and product compliance checks could be circumvented by placing products in the wrong category.
Consequence: AliExpress must submit an action plan by 20 October 2026, and failure to comply with the decision may lead to periodic penalty payments.
Multiple e-commerce imports (EU-wide)
A large-scale EU customs control action reported on 7 January 2026 checked 20,000 toys and small electronics from third-country e-commerce. More than half did not follow EU product standards, and of the selection sent for laboratory testing, 84% were found dangerous.
Consequence: Products seized, destroyed, or refused entry. With the EU DPP Registry live since 20 July 2026, customs now have a digital verification route, making this kind of enforcement faster and more systematic.
11,338 e-commerce items checked (EU-wide)
In the second phase of an EU customs priority control action, reported on 3 March 2026, 27 customs authorities worked with market surveillance and food safety authorities to check 11,338 cosmetics, personal protective equipment and food supplement items sent directly to EU consumers from outside the EU between October and December 2025.
Consequence: 65% of the cosmetics, 60% of the personal protective equipment and 63% of the food supplements checked did not comply with EU product rules, for reasons such as missing or incorrect labelling, missing documentation and forbidden ingredients.
Romania (EU Member State)
On 1 October 2026 the Commission sent Romania an additional letter of formal notice (INFR(2025)2074) for failing to ensure effective market surveillance of the EU ecodesign and energy labelling rules, as the Market Surveillance Regulation (EU) 2019/1020 requires. A first letter followed in July 2025; Romania had committed to designating its market surveillance authorities but had not yet done so.
Consequence: Romania has two months to respond and take the necessary measures, otherwise the Commission may issue a reasoned opinion. Member States must check that products meet the minimum energy requirements set under ecodesign rules and carry a correct energy label.
4,137 Safety Gate alerts (EU-wide)
4,137 Safety Gate alerts on dangerous products were notified in 2024, a record at the time that 2025 has since overtaken. Cosmetics (36%) and toys (15%) were the most notified product categories.
Consequence: National authorities took over 4,200 follow-up actions to stop the sale of these products or take them off the market.
Volkswagen Group
Installed defeat devices in 11 million vehicles to cheat emissions tests, misrepresenting environmental compliance across EU and US markets.
Consequence: Criminal convictions, massive product recalls, management prosecutions, and regulatory overhaul of vehicle emissions oversight across the EU.
Amazon Europe
Processing personal data in violation of GDPR requirements, specifically around advertising targeting and consent mechanisms.
Consequence: Largest GDPR fine issued at the time. Demonstrated that EU regulators will apply maximum pressure to major market participants.
Meta Platforms (Instagram)
Instagram processed children's personal data unlawfully, including making teen accounts public by default and exposing contact details.
Consequence: Record GDPR fine against Meta. EU signaled that data protection enforcement is accelerating, not slowing — a pattern that will carry into product compliance enforcement.
IKEA (Inter IKEA Group)
Investigation into sourcing timber from Ukrainian forests with allegations of illegal logging in protected areas, raising due diligence concerns under the EU Timber Regulation.
Consequence: Reputational damage, supply chain audit requirements, and increased scrutiny on forest-risk commodity sourcing — foreshadowing EUDR enforcement.
Samsung SDI
Battery defects in Galaxy Note 7 caused fires and explosions, leading to a global product recall and flight bans.
Consequence: Full product discontinuation, global recall of 2.5 million devices, airline bans, and long-term damage to Samsung's battery business credibility.
H&M Group
Misleading environmental sustainability claims on products through the 'Conscious Collection' marketing, misrepresenting environmental scorecards. Dutch ACM also found H&M's sustainability claims misleading.
Consequence: Class action lawsuits, regulatory investigations in Netherlands (ACM), forced withdrawal of environmental marketing claims. Preview of what EmpCo enforcement will look like from September 2026.
Decathlon
French regulator found Decathlon's environmental product ratings lacked transparency and used non-standardised methodology to claim products were 'eco-designed'.
Consequence: Forced to revise product labelling methodology and remove unsubstantiated environmental claims. Precedent for EmpCo enforcement starting September 2026.
Multiple companies (EU-wide)
EU-wide coordinated enforcement project (REF-10) found 28% of inspected products contained restricted substances above legal limits, with SVHCs undisclosed.
Consequence: Product withdrawals, import blocks, and fines across member states. Demonstrated systemic non-compliance in chemical substance reporting — the same data now required in DPPs.
4,671 Safety Gate alerts (EU-wide)
4,671 Safety Gate alerts on dangerous products were notified in 2025, the highest number since the system launched in 2003 and 13% more than in 2024. The most notified categories were cosmetics (36%), toys (16%) and electrical appliances and equipment (11%); dangerous chemicals caused 53% of alerts.
Consequence: National authorities took 5,794 follow-up actions, 35% more than in 2024, including withdrawals, recalls, stops at the border and orders to online marketplaces to remove listings. The Commission's eSurveillance webcrawler scanned over 1.6 million websites in 2025 and found more than 20,800 products offered online that were already listed in Safety Gate.
Wish (ContextLogic)
French regulators found 95% of tested electrical products and 62% of tested toys sold via Wish failed EU safety standards.
Consequence: France directed search engines and app stores to delist Wish from search results — effectively removing its market access in France. A warning for any platform selling non-compliant products.
BMW AG
European Commission found BMW colluded with other German automakers to limit the rollout of emissions cleaning technology, restricting competition on emission reduction.
Consequence: EU antitrust fine. Part of a broader pattern showing EU willingness to enforce environmental compliance through competition law as well as product regulation.
TikTok
TikTok processed children's data without adequate protections, failed to provide transparent privacy information, and used dark patterns in age verification.
Consequence: Major GDPR fine demonstrating EU enforcement against platforms regardless of origin. Pattern: EU sets high compliance bar, then enforces decisively.
What these cases reveal
Patterns emerging from enforcement actions across EU markets.
Enforcement is becoming more visible. EU regulators are increasingly publishing enforcement actions, making non-compliance a matter of public record — not a quiet internal matter.
Traceability expectations are rising. From plot-level GPS coordinates under EUDR to substance-level disclosure under REACH, regulators now expect granular, verifiable data — not self-declarations.
Lack of documentation creates operational vulnerability. Companies that cannot produce compliance evidence on demand face delays, holds, and presumption of non-compliance at customs and market surveillance checkpoints.
Compliance is shifting from paperwork to infrastructure. Digital Product Passports, registries, and traceable supply chain data are becoming the operational backbone of market access — not just a legal checkbox.
The risk is growing — here is why
The cases above happened under the old regulatory framework — before ESPR, before mandatory DPPs, before the EU's digital enforcement infrastructure was built. What is coming is structurally different.
Since 20 July 2026, the ESPR DPP Registry has been live. As each product group's delegated act takes effect, customs will release its products only after checking their DPP registration against the Registry, automatically once the Registry is connected to the EU customs single window (ESPR Article 15). Release is not proof of compliance, but a product without a valid registration can be held at the border.
From 18 February 2027, the Battery Passport is mandatory for EV, LMT and industrial batteries above 2 kWh. Battery carbon footprint declarations apply no earlier than 12 months (EV batteries) or 18 months (other categories) after the Commission's calculation-method and declaration-format acts enter into force, and neither act has been adopted yet. Detergents follow from 23 September 2029 and toys from 1 August 2030, while textiles and other ESPR product groups follow as their delegated acts are adopted. The scope only expands.
Each new delegated act under ESPR adds product categories. Each adds enforcement mechanisms. The combined effect is a compliance surface that grows every year — and with it, the risk of non-compliance.
Digital enforcement infrastructure
The DPP Registry (July 2026) creates a machine-readable compliance checkpoint. Customs can query a product's DPP status before it clears the border. No more relying on paper declarations.
Turnover-based penalties
New regulations specify penalties as a percentage of turnover — 4% (EUDR), up to 3% (CSDDD), 3% (IED). These are not flat fines. For a company doing 1B in revenue, a 4% penalty is 40M. The math changes everything.
Compounding regulation overlap
A single product can fall under ESPR, REACH, Battery Regulation, PPWR, EUDR, and EmpCo simultaneously. Non-compliance in one triggers scrutiny across all. One failure cascades.
What each regulation can cost you
Penalty rules as each EU regulation sets them. Where a regulation sets no EU-wide ceiling, each member state sets its own penalties.
Why this will not slow down
Every regulation discussed on this page is part of a larger, interconnected framework. Understanding the bigger picture helps explain why compliance pressure will only increase — and why early preparation is a strategic advantage, not just a legal necessity.
European Green Deal and Net Zero 2050
The EU has set a legally binding target to reach net-zero greenhouse gas emissions by 2050, enshrined in the European Climate Law (Regulation (EU) 2021/1119). This is not a policy aspiration — it is law.
Every product regulation — ESPR, Battery Regulation, CBAM, PPWR — is an implementation mechanism for this target. DPPs are how the EU measures and enforces product-level progress toward net zero. As 2050 approaches, enforcement will tighten, scope will expand, and scrutiny will increase.
Circular Economy Action Plan
The EU's Circular Economy Action Plan (CEAP, adopted March 2020) is the strategic blueprint that created the ESPR and the DPP concept. Its stated goal: make sustainable products the norm in the EU.
The plan mandates that products placed on the EU market must be designed for durability, reuse, repair, and recycling. The DPP is the information infrastructure that makes this verifiable. Without product-level data on materials, carbon footprint, and recyclability, the circular economy cannot function.
The full circle
The logic connects: the European Climate Law sets the 2050 net-zero target. The European Green Deal provides the policy framework. The Circular Economy Action Plan translates this into product-level requirements. The ESPR creates the legal instrument. Digital Product Passports provide the data layer. And each product-specific regulation — batteries, textiles, construction, packaging — implements this for specific industries.
This is not a single regulation you can work around. It is a systemic transformation of how products enter, exist in, and leave the EU market. Companies that build compliance infrastructure now are not just avoiding fines — they are positioning themselves for the only version of the EU market that will exist.
Sources: European Climate Law (EU) 2021/1119 — EUR-Lex; Circular Economy Action Plan COM(2020) 98 — European Commission; European Green Deal COM(2019) 640 — European Commission
Understand your exposure
The companies that build compliance infrastructure before enforcement reaches them will carry a structural advantage in every market they operate in.
Or explore: All Regulations & Timeline · Digital Product Passports · ESPR Deep Dive