ECDC has primarily the "power" to coordinate data exchange between member states, and afaik no authority to force lower-level health authorities or healthcare providers to do anything, unless member states were to explicitly adopt their suggestions as binding in local law.

The mess that's going on with ECB is an IMHO quite special situation (which also is an odd example for "already starting to penalize for violating policies". There is no "starting to", obviously EU law has enforcement tools - although the court itself can't use them)