TCO Article 18: Penalties

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

Article 18 is where the cost of getting the Terrorist Content Online Regulation wrong is set. Member States set the penalties, they are capped in scope to a named list of provisions that includes Article 17, and there is one hard number in the whole Regulation: up to 4 percent of global turnover for a systematic or persistent failure to meet the one-hour removal deadline.

Who it binds

• Hosting service providers, through their Member State's penalty rules (Article 18(1)).
• The legal representative is exposed too, though not through this article: Article 17(3) makes the representative liable for infringements of the Regulation, and Article 18(1) lists Article 17 among the provisions penalties may address.
• Member States, who have to lay down the rules, take all measures necessary to implement them, and notify the Commission (Article 18(1)).

What it makes somebody do

• Member States. Lay down penalty rules limited to infringements of the provisions Article 18(1) lists, which include Article 3(3) and (6), Article 5(1), (2), (3), (5) and (6), Articles 6, 7, 10 and 11, Article 15(1) and Article 17.
• Member States. Make those penalties effective, proportionate and dissuasive (Article 18(1)).
• Competent authorities. Take account of the seven circumstances in Article 18(2) when deciding whether to penalise and at what level, including whether the infringement was intentional or negligent, previous infringements, financial strength, level of cooperation, size, and the technical and organizational measures the provider had taken.
• Member States. Ensure that a systematic or persistent failure to comply with the one-hour deadline in Article 3(3) is subject to financial penalties of up to 4 percent of global turnover of the preceding business year (Article 18(3)).

What it does not say

• The 4 percent is not the general ceiling. Article 18(3) attaches it specifically to systematic or persistent failure on Article 3(3), the one-hour removal. Everything else is left to national law under Article 18(1).
• A single missed order is not automatically at that level. Article 18(3) says systematic or persistent, and Article 18(2) requires the authority to weigh nature, gravity and duration.
• The list in Article 18(1) is a limit, not a menu. Penalties are limited to addressing the named provisions, so a Member State cannot attach this regime to something the Regulation does not list.
• Being a small provider is a factor and not a defence. Article 18(2)(f) has the authority take size into account, alongside six other circumstances.
• Article 18(2)(g) rewards preparation directly: the degree of fault is assessed taking account of the technical and organizational measures the provider had taken to comply. What you had in place before the order arrived is part of the calculation.

How it sits beside the other mandates

• Article 3(3) is the obligation Article 18(3) prices. The one-hour clock and the 4 percent are the same fact seen from two ends.
• Article 17 is in the Article 18(1) list, so a defective or absent legal representative is itself a penalisable infringement rather than merely a precondition of receiving orders properly.
• Article 18(2)(g) is the strongest argument for resourcing an Article 17 appointment properly rather than minimally: the measures you took are read into the fault assessment.