Article 64 2.

Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5  % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.