What's the fine ceiling for SMEs specifically?

The standard penalty ceiling under Article 99(4)(g) is up to €15 million or 3% of worldwide annual turnover, whichever is higher. That's the number most press coverage quotes, and it's real, but it isn't the number that applies to most SMEs.

For SMEs and start-ups specifically, Article 99(6) sets a different ceiling: up to €15 million or 3% of turnover, whichever is lower. That single word, lower instead of higher, is the difference between a ceiling built for a multinational and one scaled to a small company's actual size.

Fines are also discretionary, not automatic, and weighed against the factors set out in Article 99(7): things like the nature and gravity of the infringement, whether it was intentional or negligent, and cooperation with authorities. €15M should be treated as a ceiling, never as "the fine you should expect."

Realistic early enforcement, per current expectations, is complaint-driven and focused on easily verifiable failures: was a disclosure shown at first interaction, and can you prove it. Corrective orders are the likely first step, well ahead of headline fines.

None of that is a reason to skip the duties. They're genuinely cheap to meet (a badge, a sentence, a label), and private-law exposure (unfair commercial practices claims, customer complaints, platform policy violations) exists independently of regulatory enforcement either way.

Worth separating from all of this: national enforcement capacity is a real-world variable, not a legal one. Whether your national authority is fully staffed or not doesn't change what the Regulation requires of you; it only changes how quickly a gap is likely to be noticed. Companies that treat the lower SME ceiling and uneven early enforcement as reasons to deprioritize compliance are reading the honest picture backwards: the duties are cheap precisely because they don't require the kind of investment that would justify betting on slow enforcement.