Cyprus Can Fine You and Prosecute You for the Same Breach
Ireland made accessibility a criminal offence. Cyprus did too — and then kept the administrative fine alongside it, expressly, in the same statute. Section 38 begins with the words "irrespective of the imposition of an administrative fine." Add a €500-a-day continuing penalty and Cyprus's small numbers stop looking small.
Quick answer
Cyprus's EAA law (Law 57(I)/2024) runs two penalty tracks simultaneously. Administratively, the competent authority can impose up to €10,000, rising to €20,000 for a subsequent breach, plus €500 for every day a breach continues. Criminally — and expressly regardless of any administrative fine already imposed — the same conduct carries up to two years' imprisonment or €20,000 or both on first conviction, and three years or €30,000 or both on a second. The competent authority is not an inspectorate but a minister: the Deputy Minister of Social Welfare. No enforcement has been reported.
Two tracks that don't wait for each other
Most member states pick a lane. Luxembourg made the substantive breach criminal and left its regulator only an obstruction fine. Ireland made it criminal, with civil compliance orders alongside. Czechia and Austria went purely administrative.
Cyprus does both, and says so in terms. Section 35 lists the conduct that constitutes a "breach" attracting an administrative fine — making a non-compliant product or service available, ignoring a compliance notice, missing the CE marking or declaration, obstructing an authorised officer, failing to hand over documents. Section 36 sets the money. Then section 38 opens:
"Irrespective of the imposition of an administrative fine under section 36, a person who — (a) makes available on the market a product or service that does not comply with this Law…commits an offence"
— Law 57(I)/2024, s. 38 (CyLaw), English translation
Note the overlap. Section 38(a) covers the same conduct as section 35(a): making a non-compliant product or service available. So placing an inaccessible service on the Cypriot market can produce an administrative fine from the Deputy Minister and a criminal prosecution, and the statute anticipates both.
The criminal penalties:
"(aa) on first conviction, is liable to imprisonment not exceeding two (2) years or to a fine not exceeding twenty thousand euro (€20,000) and/or to both such penalties; and (bb) on a second or subsequent conviction, is liable to imprisonment not exceeding three (3) years or to a fine not exceeding thirty thousand euro (€30,000) and/or to both such penalties."
— s. 38
| Administrative track (s. 36) | Criminal track (s. 38) | |
|---|---|---|
| Who imposes it | The competent authority | A criminal court |
| First time | Up to €10,000 | Up to 2 years' prison and/or €20,000 |
| Repeat | Up to €20,000 | Up to 3 years' prison and/or €30,000 |
| Continuing breach | Up to €500 per day | — |
| Can both apply? | Yes — s. 38 applies "irrespective of" any s. 36 fine |
The €500 a day is the number that matters
Section 36 looks modest until the second subsection:
"(1) The competent authority may impose an administrative fine not exceeding ten thousand euro (€10,000) on a person who commits any of the breaches provided for in section 35, and, in the event of a subsequent breach, may impose an administrative fine not exceeding twenty thousand euro (€20,000). (2) In the event of continuation of a breach for which an administrative fine has been imposed under subsection (1), the competent authority may impose a fine not exceeding five hundred euro (€500) for each day the breach continues, depending on its seriousness."
— s. 36(1)–(2)
€500 a day, with no stated ceiling and no end date other than compliance. Run it for a year and it is €182,500 — more than nine times the headline €20,000, and more than the entire criminal maximum.
That figure should look familiar. It is the same rate a French court set in June 2026, when the Tribunal judiciaire de Caen ordered a €500-a-day penalty against a retailer that failed to make its site accessible in time. The difference is that in France it took a civil action by disability organisations to produce it. In Cyprus it is a standing administrative power, available to the regulator without going to court.
Cyprus therefore belongs alongside the "until you comply" regimes — like Sweden's vite — whose real ceiling is open-ended, even though its headline figures read like a fixed-penalty country.
The regulator is a minister
Section 3(1) designates the competent authority as «ο Υφυπουργός Κοινωνικής Πρόνοιας» — the Deputy Minister of Social Welfare — with "accessibility surveillance authorities" being the government departments and services designated by him under s. 3(3).
That is unusual. Elsewhere in the 27 the enforcer is a trade inspectorate, a telecoms regulator, a market-surveillance body, or a purpose-built agency. Cyprus routes accessibility enforcement through a political office in the social-welfare portfolio, which frames it as a disability-rights matter rather than a product-compliance one — and means the identity of the enforcing authorities can be adjusted administratively rather than by amending the law.
The investigative powers are among the broadest we've read
Section 27 gives the competent authority and the surveillance authorities powers that go well past document requests:
- Access to embedded software, where needed to assess conformity — in any format, regardless of where it is stored.
- Information to establish who owns a website, where relevant to the investigation.
- Inspection at the manufacturing facility, during manufacture, or at the premises where a service is designed and implemented, expressly "in order to establish whether any non-compliance is due to negligence or a recurring error."
- Photographs, audiovisual material and recordings taken as the officer considers necessary.
- Seizure of products, of hardware and software used to provide a service, and of documents, records and electronic files expected to be used as evidence — and the power to require a demonstration of the service.
Two more details worth knowing. Under s. 27(2)(b), documents can be demanded in Greek and/or English — a meaningful accommodation compared with Czechia, which requires Czech for product documentation. And under s. 34(3), where the authority acts against a product or service it shall warn consumers, including "by issuing a notice to the media stating all necessary details… including details of the economic operator." That is the third naming-and-shaming provision in this series, after Portugal's mandatory newspaper publication and Czechia's published lists — and Cyprus's is triggered by the enforcement action, not by a conviction.
You pay for the enforcement
Section 39 lets a convicting court order the offender to compensate the authorities for the expense of seizing or detaining products, complying with a confiscation order, or otherwise exercising their powers — in addition to any other costs order. Slovenia (Art. 33) and Luxembourg (Art. 30(5)) have administrative equivalents; Cyprus's runs through the criminal court.
Unpaid administrative fines are collected as a civil debt owed to the Republic (s. 36(5)), and the route to challenge a fine is a recourse to the Administrative Court within 75 days (s. 37(4)).
Has it been enforced yet?
No administrative fines, prosecutions or compliance notices under Law 57(I)/2024 have surfaced. Cyprus is a small market with a regulator that sits inside a ministry rather than operating as a standing inspectorate, and there is no published register of accessibility decisions — so, as in Portugal and Slovenia, silence here is weak evidence rather than a documented zero of the kind Austria and Slovakia provide.
What this means for your business
Do not price Cyprus off the €10,000. Three things stack: the administrative fine, the €500-a-day continuing penalty that runs until you fix the problem, and a criminal prosecution that section 38 expressly permits in addition. A breach left unremedied for a year, then prosecuted, reaches roughly €200,000 and a custodial exposure — from a starting figure that reads like one of the mildest regimes in the Union.
- Time-to-remediate is the whole variable. The daily penalty only starts once a fine has been imposed under s. 36(1), so the window between the first enforcement contact and the first fine is worth using.
- Expect the reputational cost early. Section 34(3) puts a media notice alongside the enforcement action rather than after a conviction.
- Use the English option. You may deal with the authority in English — a real relief compared with several other markets.
Frequently asked questions
What is the EAA fine in Cyprus?
Up to €10,000 administratively, €20,000 for a subsequent breach, and €500 per day for as long as a breach continues (s. 36). Separately, criminal conviction carries up to two years' imprisonment or €20,000, rising to three years or €30,000 on a second conviction (s. 38).
Can I really be fined and prosecuted for the same thing?
Yes. Section 38 applies "irrespective of the imposition of an administrative fine under section 36," and its list of offences overlaps with the section 35 breaches.
Is the daily fine capped?
No end figure is stated. It runs at up to €500 per day while the breach continues — around €182,500 over a year.
Who enforces it?
The Deputy Minister of Social Welfare, as competent authority, together with the accessibility surveillance authorities designated under s. 3(3).
Can I submit documents in English?
Yes. Section 27(2)(b) allows the authorities to require translation into Greek and/or English.
Related
- ← Back to EAA Fines by Country — the full 27-state comparison
- Official text: Ν. 57(I)/2024 (CyLaw)
- Ireland's EAA fines — the other criminal regime, with director liability and a due-diligence defence
- France's EAA penalty — where a €500-a-day penalty had to come from a court instead
Sourcing note: quotations are from an English translation of Law 57(I)/2024, with section numbers as in the original. The Greek designation of the competent authority in s. 3(1) was checked against the official text; the Greek wording of ss. 36 and 38 has not yet been checked against the official text.
