Penalties
How much are CRA fines? Three Article 64 brackets
Published , updated .
Article 64 of the CRA sets three fine ceilings, each a euro amount or a share of total worldwide annual turnover for the preceding financial year, whichever is higher: EUR 15 000 000 or 2,5 % (Art. 64(2)), EUR 10 000 000 or 2 % (Art. 64(3)) and EUR 5 000 000 or 1 % (Art. 64(4)). Which one is in play follows from the obligation breached, not from company size. Company size matters in two places: manufacturers that are micro or small enterprises are not fined under these paragraphs for missing the 24-hour early-warning deadline of Art. 14(2)(a) or 14(4)(a) (Art. 64(10)(a), as corrected by the corrigendum published in OJ L 2025/90555 of 2 July 2025), and size is weighed when an individual fine is set (Art. 64(5)(c)).
Penalties under the Cyber Resilience Act are not one number. Article 64 of Regulation (EU) 2024/2847 (CELEX 32024R2847) fixes three administrative fine ceilings. Which ceiling is in play follows from the obligation breached. It does not follow from company size (the one size-based exception, Art. 64(10)(a), is set out below), and it is not a tariff applied to a named product.
This note states the three brackets neutrally. It does not forecast what anyone would be fined.
Three ceilings, not one figure
Most summaries quote a single large euro amount and stop. The Regulation sets three brackets. Each is a maximum: a fixed euro ceiling, or a percentage of total worldwide annual turnover for the preceding financial year, whichever is higher. The brackets describe the structure of the law. They are not a prediction about any company.
Art. 64(2): the highest bracket
The highest ceiling attaches to the essential requirements and to Articles 13 and 14.
Administrative fines up to EUR 15 000 000 or, for an undertaking, up to 2,5 % of total worldwide annual turnover for the preceding financial year, whichever is higher. (Art. 64(2), CELEX 32024R2847; paraphrase, not a verbatim Official Journal quotation)
Article 13 covers manufacturer obligations including vulnerability handling and the support period. Article 14 covers reporting of actively exploited vulnerabilities and severe incidents. Breaches tied to those duties, and to the essential requirements, sit in this bracket. Under Art. 64(10) (as corrected by the corrigendum published in OJ L 2025/90555 of 2 July 2025), the fines of this bracket do not apply to manufacturers that are micro or small enterprises for missing the 24-hour early-warning deadline of Art. 14(2)(a) or 14(4)(a), nor to open-source software stewards.
Art. 64(3): other operator obligations
The middle ceiling attaches to other operator obligations.
Up to EUR 10 000 000 or 2 % of total worldwide annual turnover for the preceding financial year, whichever is higher. (Art. 64(3), CELEX 32024R2847; paraphrase)
"Other operator obligations" is our shorthand, not the Regulation's wording: Article 64(3) lists the provisions it covers one by one, among them the importer and distributor obligations of Articles 19 and 20, the EU declaration of conformity under Article 28 and the conformity assessment procedures under Article 32(1) to (3). It is a separate column from the essential requirements and from Articles 13 and 14. Which concrete duty sits here still follows from the obligation breached, read against the role that holds it.
Art. 64(4): incorrect, incomplete or misleading information
The third bracket is the one most summaries omit.
Up to EUR 5 000 000 or 1 % of total worldwide annual turnover for the preceding financial year, whichever is higher, for incorrect, incomplete or misleading information supplied to notified bodies and market surveillance authorities. (Art. 64(4), CELEX 32024R2847; paraphrase)
This ceiling is about the quality of information given to those bodies, not about product design as such. It is still a maximum, still "whichever is higher", and still decided by the conduct described in the paragraph.
The three brackets side by side
| Paragraph | What it attaches to | Ceiling |
|---|---|---|
| Art. 64(2) | Essential requirements; Articles 13 and 14 | EUR 15 000 000 or 2,5 %, whichever is higher |
| Art. 64(3) | Other operator obligations | EUR 10 000 000 or 2 %, whichever is higher |
| Art. 64(4) | Incorrect, incomplete or misleading information to notified bodies and market surveillance authorities | EUR 5 000 000 or 1 %, whichever is higher |
Each percentage is of total worldwide annual turnover for the preceding financial year, for an undertaking. Each comparison is "whichever is higher". Dropping either phrase changes the law.
A ceiling exists only once the obligation does
Article 14 reporting obligations of manufacturers have applied since 11 September 2026. Full application of the Regulation, including technical documentation, SBOM, support period, conformity assessment and CE marking, begins on 11 December 2027. A fine ceiling for a duty that does not yet apply is not yet in play for that duty.
We do not claim that any fine has been applied to a reader, a product or a company. As of the fact base used for this note, we have no sourced CRA enforcement case to cite.
What Cybiq will and will not say
We will name which obligations attach to a role, and where each is written. We will not tell you what you would be fined. Nobody can, from a public checklist alone.
Frequently asked questions
Do CRA fines apply to open-source software?
Article 64 attaches each ceiling to an obligation (Art. 64(2) to (4)). Whether an obligation applies to free and open-source software depends on whether it is made available on the market in the course of a commercial activity (Art. 3, point (22); recitals 15 and 18). Where it is not, the obligations tied to making a product available on the market do not arise for that supply. Open-source software stewards carry their own light-touch duties under Art. 24 (recital 19), and under Art. 64(10)(b) the administrative fines of Art. 64(2) to (9) do not apply to any infringement by open-source software stewards (see also recital 120). See Free software and the CRA.
Do the fines depend on company size?
The ceilings do not: each of Art. 64(2) to (4) is set by the obligation breached and states a euro amount or a share of turnover, whichever is higher. The amount of an individual fine can: the size of the company, in particular for microenterprises and SMEs including start-ups, is one of the circumstances weighed (Art. 64(5)(c)). Art. 64(10)(a) (as corrected by the corrigendum published in OJ L 2025/90555 of 2 July 2025) and recital 120 also set out an exception: the fines of Art. 64(2) to (9) do not apply to manufacturers that qualify as microenterprises or small enterprises for missing the 24-hour early-warning deadline of Art. 14(2)(a) or 14(4)(a). The exception covers that deadline only, not the other Article 14 duties; read both in the Official Journal before relying on it.
Who enforces the CRA?
Authorities in the Member States, not Cybiq. Each Member State designates one or more market surveillance authorities for the Regulation (Art. 52(2)) and lays down the rules on penalties (Art. 64(1)); depending on the national legal system, fines may be imposed by competent national courts or other bodies (Art. 64(8)). Reports under Article 14 go to the CSIRT designated as coordinator and to ENISA (Art. 14(1), (3), (7)). We do not state here which authority imposes fines in which country.
Have any CRA fines been imposed?
We have no sourced enforcement case to cite and do not claim one. Article 14 reporting duties have applied since 11 September 2026 and Chapter IV since 11 June 2026; the rest of the Regulation applies from 11 December 2027 (Art. 71(2)).
Orientation, not legal advice. Verify against the official text before relying on any item.