Artifact GuideEU

Cyber Resilience Act penalties and fines

Article 64 sets EU-level administrative fine ceilings, while Member States lay down and implement the national penalty rules.

This page helps separate the CRA fine caps from corrective market-surveillance measures, reporting duties, and narrow derogations.

Back to main artifact Review sources

Author

Sorena AI

Published

Mar 4, 2026

Updated

Jul 31, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Mar 4, 2026

Updated Jul 31, 2026

Overview

Article 64 of the Cyber Resilience Act sets maximum administrative fine ceilings, not automatic fines. Member States must create and implement effective, proportionate, and dissuasive penalty rules. The applicable ceiling depends on the breached obligation; for an undertaking, the stated percentage of worldwide annual turnover is compared with the fixed euro amount and the higher maximum applies. National law and the facts of the case determine the authority, procedure, and amount imposed. An is outside the Article 64 administrative-fine regime but remains subject to its applicable CRA duties, market surveillance, and corrective action.

Section 1

Article 64 fine ceilings

Article 64 sets maximum administrative fine levels rather than automatic fine amounts. For undertakings, each tier uses the higher of the fixed euro ceiling or the stated percentage of total worldwide annual turnover for the preceding financial year.

The highest tier is tied to the core product-security and manufacturer/reporting duties. The middle tier covers several other economic-operator, conformity-assessment, notified-body, and authority-access obligations. A separate tier covers misleading or incomplete responses to official requests.

Up to EUR 15,000,000 or 2.5% of worldwide annual turnover for non-compliance with Annex I essential cybersecurity requirements and Articles 13 and 14.
Up to EUR 10,000,000 or 2% of worldwide annual turnover for non-compliance with Articles 18 to 23, Article 28, Article 30(1) to (4), Article 31(1) to (4), Article 32(1) to (3), Article 33(5), and Articles 39, 41, 47, 49, and 53.
Up to EUR 5,000,000 or 1% of worldwide annual turnover for supplying incorrect, incomplete, or misleading information to notified bodies or market-surveillance authorities in reply to a request.

Sources for this answer

Regulation (EU) 2024/2847, Article 64(1)-(4)

Sets the Member State penalty-rule duty, three administrative fine tiers, fixed euro amounts, turnover percentages, and higher-of calculation for undertakings.

Section 2

Obligations behind the highest tier

The EUR 15,000,000 or 2.5% ceiling is not a generic cybersecurity penalty. It is linked to Annex I and to Articles 13 and 14, so it reaches product design, vulnerability handling, manufacturer documentation, support-period decisions, user information, and incident or vulnerability reporting.

A product team should be able to show how the product met Annex I when it was placed on the market, how vulnerabilities were handled during the support period, and how Article 14 notifications were assessed and submitted.

Annex I: essential cybersecurity requirements for product properties and vulnerability handling.
Article 13: manufacturer obligations, including cybersecurity risk assessment, documentation, support-period logic, vulnerability processes, technical documentation, EU declaration of conformity, CE marking, and user information.
Article 14: reporting of actively exploited vulnerabilities and severe incidents having an impact on product security.

Section 3

Member State penalty rules and fine amounts

Member States must lay down the penalty rules and make sure they are implemented. That means national law still determines the institutional and procedural setup, including whether courts or other national bodies impose the fines.

Article 64 does not set an automatic amount for a given defect. Authorities must consider all relevant circumstances in the specific case, including the nature, gravity, duration, and consequences of the infringement, previous similar administrative fines against the same operator, and the operator's size and market share.

Public authorities and public bodies are handled by national rules on whether and to what extent administrative fines can be imposed on them.
Where several market-surveillance authorities are involved, earlier similar fines must be considered and applied fines are communicated through the Union market-surveillance information system.
Microenterprises, small and medium-sized enterprises, and start-ups are expressly relevant to proportionality when the amount is set.

Section 4

When each penalty tier can become relevant

Article 64 does not have an earlier application date. Although Chapter IV applies from 11 June 2026 and Article 14 reporting applies from 11 September 2026, Article 64 and its administrative-fine tiers apply from 11 December 2027.

A breach of an early-applying CRA obligation therefore cannot be subject to an Article 64 administrative fine before 11 December 2027. Once Article 64 applies, the authority must identify the applicable obligation, the actor bound by it, the alleged infringement, and the national enforcement route.

11 June 2026: Chapter IV applies, including notified-body provisions later covered by the middle fine tier.
11 September 2026: Article 14 reporting duties apply, including to in-scope products placed on the market before 11 December 2027, but Article 64 does not yet apply.
11 December 2027: Article 64 and its administrative-fine tiers apply with the CRA generally.

Sources for this answer

Regulation (EU) 2024/2847, Articles 64, 69, and 71

Article 71 gives Chapter IV and Article 14 earlier application dates but not Article 64; Article 69 extends Article 14 to in-scope products placed on the market before the general application date.

Section 5

Market-surveillance consequences beyond fines

CRA enforcement is not limited to money penalties. Market-surveillance authorities can evaluate products with digital elements where there is sufficient reason to consider that the product, including its vulnerability handling, presents a significant cybersecurity risk.

If a finds non-compliance, it can require corrective action, withdrawal, or recall. If adequate corrective action is not taken, it can prohibit, restrict, withdraw, or recall the product from the national market. Article 64 also allows administrative fines to be imposed in addition to corrective or restrictive measures for the same infringement.

Article 53 access requests can cover data needed to assess design, development, production, and vulnerability handling, including related internal documentation.
Article 54 procedures can lead to corrective action, withdrawal, recall, or provisional restrictions for products presenting a significant cybersecurity risk.
Article 58 formal non-compliance covers issues such as missing or incorrect CE marking, missing or incorrect EU declaration of conformity, missing notified-body identification where required, and unavailable or incomplete technical documentation.

Section 6

Narrow derogations and what not to assume

Article 64 includes narrow derogations. The corrected CRA text excludes Article 64 administrative fines for microenterprise and small-enterprise manufacturers only for failure to meet the 24-hour early-warning deadline in Article 14(2)(a) or Article 14(4)(a). It also excludes Article 64 administrative fines for infringements by open-source software stewards.

Those derogations should not be read as a general exclusion from CRA supervision. Market-surveillance authorities remain responsible for CRA market surveillance, including supervision of obligations and corrective action where those obligations are not met.

Do not treat the micro or small enterprise derogation as a blanket exemption from Article 14 or other CRA duties.
Do not treat the steward derogation as permission to ignore Article 24 obligations or market-surveillance corrective action.
Do not invent national fine schedules before the relevant Member State has implemented and published its penalty rules.

Section 7

Evidence to prepare before an authority asks

The CRA source text does not say that keeping evidence prevents a fine. It does, however, make documentation, cooperation, authority access, and case-specific circumstances central to enforcement.

Keep records that connect the product to the relevant obligation, support-period and vulnerability-handling process, authority request, and corrective action.

Annex I traceability: cybersecurity risk assessment, essential-requirement mapping, test evidence, and vulnerability-handling records.
Article 13 records: technical documentation, EU declaration of conformity history, CE-marking basis, support-period rationale, user information, contact point, and update availability records.
Article 14 records: awareness timestamps, vulnerability or incident classification, notification submissions, user communications, remediation decisions, and follow-up actions.
Authority-response records: copies of requests, supplied information, internal documentation reviewed, translations if needed, and checks that responses were complete and not misleading.

Recommended next step

Check CRA penalty exposure against product and reporting evidence

Use Research Copilot to review which CRA obligations are implicated by a product issue, authority request, vulnerability report, or incident timeline, with citations back to the source text.

Research workflow

Open Research Copilot

Ask cited questions about Article 64, market-surveillance measures, and the records needed for a specific CRA issue.

Explore next step

Talk to Sorena

Discuss CRA enforcement readiness

Review product-security, vulnerability-handling, reporting, and authority-response evidence for products with digital elements.

Explore next step

Primary sources

References and citations

Cyber Resilience Act corrigendum of 2 July 2025

eur-lex.europa.eu

Referenced sections

Supports the corrected reading of the Article 64(10) derogations for microenterprise and small-enterprise manufacturers and open-source software stewards.

Regulation (EU) 2024/2847, Article 64(1)-(4)

data.europa.eu

Referenced sections

Sets the Member State penalty-rule duty, three administrative fine tiers, fixed euro amounts, turnover percentages, and higher-of calculation for undertakings.

Regulation (EU) 2024/2847, Articles 64, 69, and 71

data.europa.eu

Referenced sections

Article 71 gives Chapter IV and Article 14 earlier application dates but not Article 64; Article 69 extends Article 14 to in-scope products placed on the market before the general application date.

Regulation (EU) 2024/2847, Cyber Resilience Act

data.europa.eu

Referenced sections

Supports the Article 64 fine ceilings, Member State penalty-rule requirement, fine-setting factors, staged application dates, market-surveillance measures, authority access to documentation, and representative-action context.