Cyber Resilience Act penalties and fines

Article 64 sets maximum administrative fine levels rather than automatic fine amounts. For undertakings, each tier uses the higher of the fixed euro ceiling or the stated percentage of total worldwide annual turnover for the preceding financial year.

The highest tier is tied to the core product-security and manufacturer/reporting duties. The middle tier covers several other economic-operator, conformity-assessment, notified-body, and authority-access obligations. A separate tier covers misleading or incomplete responses to official requests.

The EUR 15,000,000 or 2.5% ceiling is not a generic cybersecurity penalty. It is linked to Annex I and to Articles 13 and 14, so it reaches product design, vulnerability handling, manufacturer documentation, support-period decisions, user information, and incident or vulnerability reporting.

For a product team, the highest-risk evidence gaps are usually the ones that make it hard to show how the product met Annex I at market placement, how vulnerabilities were handled during the support period, and how Article 14 notifications were assessed and submitted.

Member States must lay down the penalty rules and make sure they are implemented. That means national law still determines the institutional and procedural setup, including whether courts or other national bodies impose the fines.

Article 64 does not set an automatic amount for a given defect. Authorities must consider all relevant circumstances in the specific case, including the nature, gravity, duration, and consequences of the infringement, previous similar administrative fines against the same operator, and the operator's size and market share.

CRA enforcement is not limited to money penalties. Market-surveillance authorities can evaluate products with digital elements where there is sufficient reason to consider that the product, including its vulnerability handling, presents a significant cybersecurity risk.

If the authority finds non-compliance, it can require corrective action, withdrawal, or recall. If adequate corrective action is not taken, it can prohibit, restrict, withdraw, or recall the product from the national market. Article 64 also allows administrative fines to be imposed in addition to corrective or restrictive measures for the same infringement.

Article 64 includes narrow derogations. The corrected CRA text excludes Article 64 administrative fines for microenterprise and small-enterprise manufacturers only for failure to meet the 24-hour early-warning deadline in Article 14(2)(a) or Article 14(4)(a). It also excludes Article 64 administrative fines for infringements by open-source software stewards.

Those derogations should not be read as a general exclusion from CRA supervision. Market-surveillance authorities remain responsible for CRA market surveillance, including supervision of open-source software steward obligations and corrective action where those obligations are not met.

The CRA source text does not say that keeping evidence prevents a fine. It does, however, make documentation, cooperation, authority access, and case-specific circumstances central to enforcement.

The useful preparation is therefore concrete: keep records that connect the product, the breached or satisfied obligation, the support-period and vulnerability-handling process, the authority request, and any corrective action taken.