Essential Companies – up to €10 million fines or 2% of global annual revenue
Important Companies – up to €7 million fines or 1.4% of global annual revenue
Management can face legal consequences, as well as be forced to take courses on cybersecurity if non-compliant.