Cyber Resilience Act penalties and fines

Article 64 sets maximum administrative fine levels rather than automatic fine amounts. For undertakings, each tier uses the higher of the fixed euro ceiling or the stated percentage of total worldwide annual turnover for the preceding financial year.

The highest tier is tied to the core product-security and manufacturer/reporting duties. The middle tier covers several other economic-operator, conformity-assessment, notified-body, and authority-access obligations. A separate tier covers misleading or incomplete responses to official requests.

The EUR 15,000,000 or 2.5% ceiling is not a generic cybersecurity penalty. It is linked to Annex I and to Articles 13 and 14, so it reaches product design, vulnerability handling, manufacturer documentation, support-period decisions, user information, and incident or vulnerability reporting.

A product team should be able to show how the product met Annex I when it was placed on the market, how vulnerabilities were handled during the support period, and how Article 14 notifications were assessed and submitted.

Member States must lay down the penalty rules and make sure they are implemented. That means national law still determines the institutional and procedural setup, including whether courts or other national bodies impose the fines.

Article 64 does not set an automatic amount for a given defect. Authorities must consider all relevant circumstances in the specific case, including the nature, gravity, duration, and consequences of the infringement, previous similar administrative fines against the same operator, and the operator's size and market share.

Article 64 does not have an earlier application date. Although Chapter IV applies from 11 June 2026 and Article 14 reporting applies from 11 September 2026, Article 64 and its administrative-fine tiers apply from 11 December 2027.

A breach of an early-applying CRA obligation therefore cannot be subject to an Article 64 administrative fine before 11 December 2027. Once Article 64 applies, the authority must identify the applicable obligation, the actor bound by it, the alleged infringement, and the national enforcement route.

CRA enforcement is not limited to money penalties. Market-surveillance authorities can evaluate products with digital elements where there is sufficient reason to consider that the product, including its vulnerability handling, presents a significant cybersecurity risk.

If a market-surveillance authority finds non-compliance, it can require corrective action, withdrawal, or recall. If adequate corrective action is not taken, it can prohibit, restrict, withdraw, or recall the product from the national market. Article 64 also allows administrative fines to be imposed in addition to corrective or restrictive measures for the same infringement.

Article 64 includes narrow derogations. The corrected CRA text excludes Article 64 administrative fines for microenterprise and small-enterprise manufacturers only for failure to meet the 24-hour early-warning deadline in Article 14(2)(a) or Article 14(4)(a). It also excludes Article 64 administrative fines for infringements by open-source software stewards.

Those derogations should not be read as a general exclusion from CRA supervision. Market-surveillance authorities remain responsible for CRA market surveillance, including supervision of open-source software steward obligations and corrective action where those obligations are not met.

The CRA source text does not say that keeping evidence prevents a fine. It does, however, make documentation, cooperation, authority access, and case-specific circumstances central to enforcement.

Keep records that connect the product to the relevant obligation, support-period and vulnerability-handling process, authority request, and corrective action.