Chapter VII — Competent authorities
Criminal penalties
Summary
Allows Member States to decide to lay down rules on criminal penalties for breaches of DORA, in addition to or instead of administrative penalties. Where criminal penalties are chosen, Member States must ensure that the relevant competent authorities have the necessary powers.
Key Requirements
- 1
Member States may choose criminal penalties for DORA breaches
- 2
Criminal penalties may supplement or replace administrative penalties
- 3
Competent authorities must be granted necessary enforcement powers
- 4
Coordination with judicial and law enforcement authorities required
Detailed Analysis
Article 52 provides Member States with the option to establish criminal penalties for breaches of DORA requirements, either in addition to or instead of the administrative penalties framework established under Article 50. This reflects the principle of Member State sovereignty in criminal law matters while ensuring that the full spectrum of enforcement tools is available.
The decision to apply criminal sanctions is left to each Member State, recognizing that criminal law traditions and frameworks vary significantly across the EU. Some Member States may consider criminal penalties appropriate for the most serious breaches — such as deliberate concealment of major incidents or systematic non-compliance with ICT risk management requirements — while relying on administrative penalties for lesser violations.
Where a Member State opts for criminal penalties, it must ensure that the competent authorities have all necessary powers to cooperate effectively with judicial and law enforcement authorities. This includes the ability to share information, coordinate investigations, and ensure that criminal proceedings do not undermine supervisory oversight of the affected entity.
Ready to automate compliance with Article 52?
Valendir maps every DORA requirement to actionable controls, evidence, and workflows.