CRA Penalties: The 3 Fine Tiers up to €15 Million Explained

CRA penalties are set in three tiers by Article 64 of Regulation (EU) 2024/2847, and the top tier is larger than NIS2’s: up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher, for a product that fails the essential cybersecurity requirements of Annex I or a manufacturer that fails its Article 13 obligations or its Article 14 reporting duties. Below that sit EUR 10 million or 2% for the obligations of importers, distributors, notified bodies and the conformity-assessment machinery, and EUR 5 million or 1% for supplying incorrect, incomplete or misleading information to a notified body or market surveillance authority. The fines are imposed by national market surveillance authorities under national rules, they can be stacked on top of a withdrawal or recall, and two carve-outs — for micro and small enterprises that miss a reporting deadline, and for open-source software stewards — narrow who pays. This guide sets out the three tiers with the articles they attach to, the factors that scale a fine, the exemptions, the non-financial measures that arrive first, and when each exposure begins.

The three tiers of CRA penalties

Read the CRA penalties tiers by who they reach. Tier 1 is the manufacturer’s tier: a product without an SBOM, shipped with a known exploitable vulnerability, supported for less than the Article 13(8) minimum of five years, or whose actively exploited vulnerability was not notified within 24 hours, all sit here. Tier 2 reaches the rest of the supply chain — an importer that places a non-conforming product on the market, a distributor that fails its verification duties — and the manufacturer’s own paperwork failures around the declaration, the CE marking and the technical documentation. Tier 3 is about candour under investigation. Our guide to the EU CRA covers the obligations the tiers attach to.

What scales the fine

Article 64(1) leaves the rules to Member States, requiring only that penalties be “effective, proportionate and dissuasive”, and Article 64(5) lists what must be weighed in every case:

• the nature, gravity and duration of the infringement and of its consequences;
• whether administrative fines have already been applied by the same or another market surveillance authority to the same economic operator for a similar infringement;
• the size — “in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups” — and the market share of the operator.

Two structural rules sit alongside. Article 64(6) requires authorities that fine to tell the other Member States’ authorities through the Regulation (EU) 2019/1020 information system, so a fine in one country is known to the others before a similar case there. And Article 64(9) allows fines “in addition to any other corrective or restrictive measures applied by the market surveillance authorities for the same infringement” — the fine and the recall are not alternatives.

Who is exempt from CRA penalties

The first exemption is narrower than it is usually reported. A small manufacturer that misses the 24-hour early warning is spared the fine; one that never submits the 72-hour vulnerability notification or the 14-day final report is not. And the exemption is from the fine only — the reporting obligation itself still applies, and Article 14(8)’s duty to inform users still applies.

What arrives before the fine

CRA penalties are the last step of a market-surveillance procedure, not the first. Under Article 54 a national authority that finds a product presenting a significant cybersecurity risk requires the operator to bring it into conformity, withdraw it or recall it within a set period; if the operator does not, the authority takes the measures itself and notifies the Commission and the other Member States. Article 57 allows the same measures for a product that is compliant but still presents a significant risk. Article 58 covers formal non-compliance — CE marking wrongly affixed or missing, no declaration of conformity, technical documentation unavailable — and again leads to withdrawal or recall if not corrected. Article 60 gives authorities the power to run coordinated “sweeps” of product categories. The commercial consequence of withdrawal usually exceeds the fine, which is why the fine tiers are the wrong number to plan around.

When each exposure begins

The reporting exposure is the first of the CRA penalties to go live and reaches furthest. From 11 September 2026 a manufacturer with connected products on the EU market — whenever they were placed there — that learns of an actively exploited vulnerability and does not notify within 24 hours is in the top tier, and the exemption in Article 64(10)(a) covers only micro and small enterprises. Our guide to the CRA reporting deadline covers the workflow; the CRA vs NIS2 comparison sets the fines against the NIS2 scale of EUR 10 million or 2%.

Reducing exposure to CRA penalties

1. Know which tier each obligation sits in. Keep a register of the Article 13 duties and the Annex I requirements — Tier 1 — separate from the Chapter III paperwork — Tier 2.
2. Build the Article 14 workflow now. Awareness triggers, the 24/72-hour clocks, the single reporting platform end-point, user notification under 14(8). It is the earliest and highest exposure.
3. Determine and document the support period. Article 13(8) requires at least five years and requires the reasoning to be in the technical documentation under Annex VII.
4. Answer authorities completely. Tier 3 is cheap to avoid and turns a Tier 2 paperwork case into two fines.
5. Classify before December 2027. Annex III and IV products need a notified body or a certification scheme; a self-assessed important product is a Tier 2 conformity-assessment breach on top of a Tier 1 essential-requirements exposure. Our guide to CRA classification covers the tiers.

Frequently asked questions

What is the maximum fine under the CRA?
Up to EUR 15 million or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher, under Article 64(2), for non-compliance with the Annex I essential cybersecurity requirements or the Article 13 and 14 obligations.

Who imposes CRA penalties?
National market surveillance authorities under rules each Member State lays down under Article 64(1); depending on the legal system, national courts may impose them under Article 64(8). Authorities notify each other of fines through the Regulation (EU) 2019/1020 system.

Are small companies exempt?
Only in one respect: Article 64(10)(a) exempts micro and small enterprises from fines for missing the 24-hour early-warning deadlines in Article 14(2)(a) and 14(4)(a). Every other obligation and its fine applies, with size weighed under Article 64(5)(c).

Do open-source projects face fines?
Open-source software stewards face no administrative fines under Article 64(10)(b). A manufacturer that monetises open-source software as a product remains a manufacturer and is fined as one.

Can a fine be added to a recall?
Yes. Article 64(9) allows administrative fines in addition to any corrective or restrictive measures applied for the same infringement.

Where this leaves you

Plan CRA penalties by tier and by date: the Tier 1 reporting exposure opens on 11 September 2026 for every product already on the market, the Tier 1 product and Tier 2 paperwork exposures open on 11 December 2027, and all of them sit behind withdrawal and recall powers that cost more than the fine. Build the reporting workflow first, document the support period, classify early, and answer authorities in full.

References

• Regulation (EU) 2024/2847 — Cyber Resilience Act — Article 64 (penalties), Articles 54 to 60 (market surveillance), Article 69 (transitional provisions), Article 71 (application).
• Regulation (EU) 2019/1020 on market surveillance — The market surveillance framework the CRA is enforced through; Article 34 information system.

More on the EU CRA

• CRA penalties — you are here
• EU CRA: the Cyber Resilience Act explained
• The CRA reporting deadline: 11 September 2026
• CRA vs NIS2
• CRA product classification
• CRA conformity assessment

The Reporting Obligations Procedure, the Legacy Product Reporting Readiness Assessment, the Notified Body Engagement Procedure and the EU Declaration of Conformity templates are in the EU CRA Toolkit, or start with the free templates.