Cyber Resilience Act fines: the three tiers and how they're set

The Cyber Resilience Act (CRA) sets three tiers of maximum fines in Article 64. The top one, up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, covers breaches of the Annex I security requirements and the manufacturer duties in Articles 13 and 14. National authorities set the actual amount case by case, and they must take the company's size into account.

The three tiers

Tier	What it covers	Maximum fine	Source
Top	The essential requirements in Annex I, and the manufacturer duties in Article 13 (design, vulnerability handling, support period) and Article 14 (reporting)	€15 million or 2.5% of worldwide annual turnover for the previous financial year, whichever is higher	Article 64(2)
Middle	Duties of other operators (Articles 18 to 23), the declaration of conformity (Article 28), the CE mark (Article 30(1) to (4)), the technical documentation (Article 31(1) to (4)), the conformity assessment (Article 32(1) to (3)), the simplified documentation form (Article 33(5)) and certain duties of notified bodies	€10 million or 2%, whichever is higher	Article 64(3)
Lowest	Giving incorrect, incomplete or misleading information to notified bodies or market surveillance authorities in reply to a request	€5 million or 1%, whichever is higher	Article 64(4)

These are ceilings. The law doesn't set a minimum.

What "whichever is higher" means for a small firm

People often read the percentage as the cap for small companies. It isn't. The cap is the larger of the two numbers.

Take a device maker with €4 million turnover. 2.5% of that is €100,000, and €15 million is far bigger, so the legal maximum for a top-tier breach is €15 million. For a firm with €1 billion turnover, 2.5% is €25 million, which becomes the cap.

That sounds alarming for a 20-person company, and the next section matters just as much.

How the amount is chosen

Each member state writes its own penalty rules, which must be effective, proportionate and dissuasive (Article 64(1)). When an authority sets a fine, it looks at all the circumstances, and in particular (Article 64(5)):

• the nature, gravity and duration of the breach and its consequences;
• whether fines were already imposed on the same company for a similar breach;
• the size and market share of the company, with explicit mention of micro, small and medium-sized enterprises and start-ups.

In some countries a court imposes the fine rather than the authority (Article 64(8)). Fines can come on top of other measures for the same breach (Article 64(9)), such as an order to fix, withdraw or recall the product.

Reliefs written into the law

Two groups get specific relief from fines (Article 64(10)):

• Micro and small enterprises can't be fined for missing the 24-hour early warning deadline for an actively exploited vulnerability or a severe incident (Article 14(2)(a) and 14(4)(a)). The early warning is still required, and the 72-hour notification and final report are not covered by this relief.
• Open-source software stewards, the foundations and similar bodies that support open-source projects meant for commercial use, can't be fined under this regulation.

Medium-sized companies don't get the first relief. Our small companies guide explains the size thresholds.

Not only fines

Consumer groups can bring collective actions against breaches that harm consumers' interests (Article 65). And if you know or have reason to believe your product doesn't meet Annex I, you must correct it at once, or withdraw or recall it (Article 13(21)). For a small hardware company, a recall is a real cost of its own.

Where the risk really sits

For a small device maker, the biggest exposure is in the top tier. Two duties apply already or soon:

1. Reporting, live since 11 September 2026. A missed 72-hour notification is an Article 14 breach.
2. Annex I, from 11 December 2027. Selling a product with a known exploitable vulnerability can breach Annex I, Part I, (2)(a).

Both come down to knowing what is inside your firmware. You can't report a flaw in a part you didn't know you shipped.

What Proofsheet does here

Start with the free peek: upload one file and the app generates a one-page report with your top 3 risks, at no cost. The full report (€99) lists the parts and versions the app can see, matches exact versions against the NVD, marks CVEs on CISA's known exploited list and maps the evidence to the 22 Annex I points. "No known exploitable vulnerabilities" never goes above partial, because a scan finding nothing isn't proof.

The report can't say whether you'd be fined, or how much. What the app generates is technical evidence, not a legal certificate.

Generate a free report, or read about reporting and the small company rules.