Skip to content

What Non-Compliance Actually Costs: The Fine Numbers

Compliance conversations get vague fast: "risks", "exposure", "potential penalties". Numbers are better. Here are the penalty figures behind the most common obligations a small exporter meets — and the reason they matter more for small companies, not less.

The headline figures

GDPR. Cumulative fines across the EU have passed €5 billion since 2018, with the largest single penalty — €1.2 billion against Meta in 2023 — dwarfing everything else. But the volume is in the small cases: thousands of fines under €100,000 against ordinary businesses for paperwork, consent and notification failures.

CPSC. US consumer product safety violations carry civil penalties up to roughly $125,000 per violation, with multi-million ceilings for related violations, plus recalls at the company's expense. The recall is usually the expensive part.

Prop 65. California's private-enforcer machine files thousands of 60-day notices every year. The overwhelming majority end in settlement, typically $15,000 to $50,000 each plus legal fees — often against small sellers with no warning system in place.

EUDR. The deforestation regulation sets penalties up to 4% of a company's annual EU turnover, plus confiscation of the goods and exclusion from procurement. For a small importer, one wrong shipment can exceed the profit of the entire category.

CBAM. Unreported embedded emissions in the definitive phase run €10 to €50 per tonne, with higher multipliers for repeat offenders — on top of the certificate purchase obligation itself.

UFLPA. US customs has detained thousands of shipments under the forced-labour rules since 2022, worth billions of dollars in total, with release conditional on proving the supply chain — a process measured in months.

Why the size matters

Here's the uncomfortable arithmetic: Volkswagen absorbed a $30 billion scandal and kept selling cars. A $500,000 penalty, a confiscated container or a year of detention can end a 15-person importer outright. The fines aren't proportional to company size — 4% of EU turnover is 4% whether you turn over €2 million or €2 billion — but the survival buffer behind them is. We wrote the case-study version of this and the customs version this week.

What the numbers can't show

Fines are the visible part. The invisible parts — a buyer who drops you, a platform that suppresses your listing, a bank that re-prices your credit — usually cost more, but they don't show up in enforcement statistics. The fines matter because they're the canary: by the time a penalty lands, the trust damage is already done.

The defence is the same in every one of these regimes: evidence, kept current, that you did the work. A due diligence statement, a declaration, a certificate — published, dated and verifiable — is what turns an enforcement letter into a closed file. We covered the EUDR machinery in the compliance guide and the Prop 65 side in the warnings guide.

How Sustalium Helps You Avoid the Numbers

  • Evidence before enforcement — declarations, certificates and due diligence records published and verifiable before anyone asks.
  • One current version — the document an authority checks is the one you maintain, not a PDF of uncertain vintage.
  • The whole stack in one place — GDPR to CBAM to Prop 65, at one address your team actually keeps updated.

A Fine Lands When the Evidence Is Missing. Keep It Published.

The cheapest insurance against every number on this page is a current, verifiable document. Start with a free draft: no card needed, publish the verifiable version when you are ready.

[See Which Frameworks Apply to You →](/countries/map/){ .md-button .md-button--primary }

Frequently Asked Questions

Which fines hit small businesses most often?

In practice: Prop 65 settlements in the US, GDPR paperwork fines in the EU, and CPSC actions on imported consumer goods. All three target the under-documented.

Are the maximums ever actually imposed on small firms?

The maximums rarely, but the minimums of a process are expensive on their own — a six-month customs hold, a recall, a settlement with legal fees. The fine is often the cheapest part.

What's the cheapest prevention?

A current declaration per product and per obligation, published where it can be checked. That's the whole of the prevention argument, and it costs less than one Prop 65 settlement.

Last updated: June 14, 2026

Global Digital Trust & Compliance

Sustalium is the digital-first platform for managing complex business certificates and sustainability declarations across global supply chains.

Environment & ESG
  • Digital Product Passport (DPP)
  • Carbon & Water Footprint
  • Circularity & Reuse (ISO 14021)
  • De-Forestation Free
Product & Food Safety
  • FSMA 204 (FDA Traceability)
  • REACH & RoHS Compliance
  • PFAS-Free & VOC Declarations
  • Prop 65 & TSCA Title VI
Social & Ethical
  • ISO 26000 Responsibility
  • Modern Slavery Statements
  • UFLPA Forced Labor Traceability
  • Ethical Labor Declarations
Governance & Trade
  • Swiss Made & Origin Claims
  • GDPR & AI Ethics (EU AI Act)
  • CE Marking & UKCA Conformity
  • Bill S-211 (Canada) Reporting
Start Free View Supported Compliances

Have questions about a specific standard?
Contact our compliance team at compliance@sustalium.com