EU Cyber Resilience Act, CRA Product Security and CE Marking Penalties and Fines

Article 64 creates three maximum administrative fine brackets. For undertakings, the percentage of worldwide annual turnover is compared with the fixed amount and the higher figure applies.

The practical message is simple. The closer an issue is to Annex I, Article 13, or Article 14, the more urgent it becomes.

The top bracket combines product weaknesses and process failures. A team can be exposed because the product was not secure by default, because vulnerabilities were not handled during the support period, or because an actively exploited vulnerability or severe incident was not reported on time.

The cleanest way to reduce this exposure is to build a technical file and support workflow that show diligence before an authority asks for it.

Article 64 says authorities should consider the nature, gravity, duration, and consequences of the infringement, whether similar fines were already applied, and the size and market share of the economic operator.

This means repeat failures and poor remediation posture make a bad situation materially worse.

Article 64(10), as corrected by the July 2025 corrigendum, creates specific derogations. The administrative fines referred to in paragraphs 2 to 9 do not apply to manufacturers that qualify as microenterprises or small enterprises with regard to failure to meet the twenty four hour early warning deadline in Article 14(2)(a) or Article 14(4)(a). The same derogation excludes those administrative fines for open source software stewards.

Do not overread this. It is a narrow derogation, not a general exemption from CRA duties.

Good evidence does not eliminate risk, but it changes the conversation. Authorities look more favourably on operators that can show traceability, prompt remediation, and disciplined reporting.

The most useful evidence is generated as part of the normal release and support process.