Article 64 establishes penalties: (a) breach of essential cybersecurity requirements (Annex I) and Article 13/14 manufacturer obligations and reporting - administrative fines up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher; (b) breach of other obligations - administrative fines up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher; (c) supply of incorrect, incomplete or misleading information to notified bodies or market surveillance authorities - administrative fines up to EUR 5 million or 1% of worldwide annual turnover, whichever is higher.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.