CRA Penalties and Fines

Under the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, the most serious infringements can lead to administrative fines of up to €15 million or 2.5% of worldwide annual turnover. The higher of the two amounts applies. These penalties enforce the obligations that the Cyber Resilience Act places on manufacturers, importers, and distributors. Knowing how far the fines reach also helps you judge the weight of each obligation.

Contents

1. What the CRA says about penalties
2. The three penalty tiers
3. How is the amount of a fine determined?
4. What relief applies to microenterprises and small enterprises?
5. Why open-source software stewards are exempt from fines
6. Who imposes CRA penalties?
7. Relationship to withdrawal and recall

What the CRA says about penalties

Article 64 of the CRA requires Member States to lay down penalties for infringements of the regulation. The CRA sets three maximum levels for administrative fines, graded by severity, from up to €15 million down to up to €5 million. How the penalties are designed and imposed is left to national law. They must, however, be effective, proportionate, and dissuasive.

Laying down the penalties is therefore up to the Member States. Under Article 64(1), they adopt the rules, take the measures necessary to implement them, and notify them to the Commission. The CRA only sets the common EU framework by defining the maximum levels and the obligations that are subject to penalties.

The three penalty tiers

The CRA grades the maximum administrative fines by the severity of the infringement. What matters is which obligation was infringed. For undertakings, the higher of two values applies: the fixed amount in euros or the percentage of total worldwide annual turnover for the preceding financial year.

Tier	Maximum fine	Obligations concerned
1	up to EUR 15 million or 2.5%	Essential cybersecurity requirements (Annex I), obligations of manufacturers (Article 13), reporting obligations (Article 14)
2	up to EUR 10 million or 2%	Obligations of authorized representatives, importers, and distributors (Articles 18 to 23), of notified bodies, and further procedural obligations (including Articles 28, 30 to 33, 39, 41, 47, 49, and 53)
3	up to EUR 5 million or 1%	Incorrect, incomplete, or misleading information supplied to notified bodies and market surveillance authorities

The highest tier covers the core of the regulation. It applies when a product does not meet the essential cybersecurity requirements in Annex I. It also applies when a manufacturer infringes its obligations under Article 13 or the reporting obligations under Article 14. A connected embedded controller with a web interface that is placed on the market without effective protection against unauthorized access therefore falls into the most severe penalty category.

The middle tier mainly covers procedural, verification, and marking obligations. These include the obligations of importers and distributors and a range of obligations of notified bodies and other actors.

The lowest tier applies only to incorrect information supplied to notified bodies and market surveillance authorities in reply to a request.

How is the amount of a fine determined?

Within the maximum levels, the amount is not arbitrary. In each individual case, the market surveillance authority takes all relevant circumstances into account. Article 64(5) of the CRA explicitly names three criteria:

• the nature, gravity, and duration of the infringement and of its consequences (point (a));
• whether the same or another market surveillance authority has already imposed administrative fines on the economic operator for a similar infringement (point (b));
• the size and market share of the operator, in particular with regard to microenterprises and small and medium-sized enterprises (SMEs), including start-ups (point (c)).

These criteria can work in either direction. Recital 120 of the CRA states that a persisting infringement by the same operator in several Member States can be an aggravating factor. Taking account of penalties already imposed in other Member States, by contrast, has a mitigating effect.

The total of all fines that several Member States impose on the same operator for the same type of infringement must respect the principle of proportionality. For a person that is not an undertaking, the authority considers the general level of income in the Member State and the person's economic situation (Recital 121 of the CRA).

What relief applies to microenterprises and small enterprises?

Microenterprises and small enterprises benefit from a targeted exemption. These manufacturers are not subject to administrative fines if they only miss the 24-hour deadline for the early warning notification. This covers actively exploited vulnerabilities and severe incidents alike (Article 14(2), point (a), or Article 14(4), point (a)). The reporting obligation itself remains. Only the most severe penalty for simply missing this first deadline no longer applies. Recital 120 adds that Member States should not impose other financial penalties on these companies in this case either.

This relief only works as intended since the corrigendum of July 2, 2025. In the originally published version, the exemption derogated only from paragraphs 3 to 9 of the penalties article, not from paragraph 2. Yet paragraph 2 contains the highest fine of up to €15 million, which covers infringements of the reporting obligations under Article 14.

Under the original wording, microenterprises and small enterprises could therefore have faced the highest penalty tier for missing the 24-hour deadline, despite the intended exemption. The corrigendum extends the exemption to paragraphs 2 to 9 and so includes the highest tier. This makes a real difference for these companies: simply missing the early warning deadline can no longer be punished with the €15 million fine.

Why open-source software stewards are exempt from fines

A second exemption concerns open-source software stewards. Administrative fines do not apply to them for any infringement of the regulation. This exemption is complete and not limited to individual obligations. Recital 120 adds that Member States should not impose other financial penalties on open-source software stewards either.

The special role of these actors under the CRA is covered in our page on open-source software under the CRA.

Who imposes CRA penalties?

The CRA sets the maximum levels, while enforcement lies with the Member States. Which body imposes a fine depends on the national legal system. Member States can apply their rules so that fines are imposed by competent national courts or by other bodies, according to the competences established at national level. The application must have an equivalent effect in all Member States. In Germany, for example, this means the usual division between market surveillance authorities and judicial review.

When each underlying obligation starts to apply follows from the CRA's transitional periods. An infringement can only be penalized if the infringed obligation already applied at the time in question.

Relationship to withdrawal and recall

Fines do not stand alone. Depending on the circumstances of each case, they can be imposed in addition to other corrective or restrictive measures that a market surveillance authority applies for the same infringement.

Such measures range from an order to bring a product into compliance, to restrictions on making it available, to withdrawal from the market and recall of products already delivered. They follow the general market surveillance framework of the Market Surveillance Regulation (Regulation (EU) 2019/1020), on which the CRA builds.

A single infringement can therefore have several consequences at once: the obligation to correct the product or take it off the market, and a fine on top. When an authority imposes a fine, it informs the market surveillance authorities of the other Member States. It does so through the information and communication system provided for in Regulation (EU) 2019/1020. Enforcement is therefore connected across the EU.