Penalties
The scale
| Breach | Ceiling |
|---|---|
| Non-compliance with the Annex I essential requirements and the obligations in Articles 13 and 14 (manufacturer obligations, reporting) | EUR 15,000,000 or 2.5 % of total worldwide annual turnover for the preceding financial year — whichever is higher |
| Non-compliance with any other obligation under the Regulation | EUR 10,000,000 or 2 % |
| Supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities | EUR 5,000,000 or 1 % |
Two structural points:
- open-source software stewards are not liable to administrative fines — see The open-source software steward;
- the situation of micro, small and medium-sized enterprises, including start-ups, is taken into account when setting the amount.
Member States set the national penalty regime within these ceilings and notify it to the Commission.
Modulating criteria
The amount is not mechanical. Account is taken, among other things, of:
- the nature, gravity and duration of the infringement and its consequences;
- whether the breach was intentional or negligent;
- measures taken to mitigate the harm suffered by users;
- previous infringements by the same operator;
- the degree of cooperation with the authorities;
- financial benefits gained from the breach, or losses avoided;
- the size of the undertaking, in particular whether it is an SME.
What that says about your posture. A documented file, traced decisions and immediate cooperation move the dial far more than technical perfection. The register of decisions — report or do not report, fix or document in a VEX — is the central defensive record.
Non-financial measures
They are often heavier than the fine, and they arrive faster.
| Measure | Effect |
|---|---|
| Order to bring into conformity within a set period | Emergency mobilisation, roadmap trade-offs |
| Restriction or prohibition of making available on the Union market | Sales stop |
| Withdrawal from the market | Pulling stock and distribution channels |
| Recall of the product | Logistics cost, replacement cost, media exposure |
| Publication of the decision | Lasting reputational effect |
| Union-level emergency measures | In case of significant risk, via the safeguard procedure |
For most players, a few months’ prohibition on making a product available in the Union costs several times the maximum fine.
Sizing your exposure
The calculation to bring to the committee fits in three lines:
- Administrative exposure: 2.5 % of consolidated turnover for the last financial year, compared with EUR 15 m — take the higher.
- Commercial exposure: share of turnover made in the Union, multiplied by the plausible duration of a prohibition on making available.
- Contractual exposure: penalties and termination rights in your customer contracts in the event of regulatory non-compliance.
The method is detailed in Exposure.
Civil liability
The CRA combines with Directive (EU) 2024/2853 on liability for defective products, which now expressly covers software and takes the absence of security updates into account when assessing defectiveness.
Consequence: a CRA breach — support period not honoured, fix not distributed, known vulnerability untreated — becomes evidence in a liability claim, independently of any administrative penalty.
Insurance
Two points to work through with the broker:
- the exclusion clauses in cyber policies where a known regulatory obligation was not met;
- cover for recall costs and forced remediation, which standard cyber policies rarely include.