Cyber Resilience Act fines and penalties: the cost of non-compliance

By Kike Gandia · Co-Founder & CEO, OSCP

The Cyber Resilience Act is not a recommendation or a voluntary framework. It is a European regulation with a specific penalty regime that can reach €15 million or 2.5% of the company's total annual global turnover — whichever is higher. And it does not only affect manufacturers: importers and distributors can also be sanctioned. This guide details the three penalty tiers, which violations trigger them, who can be sanctioned and how to mitigate the risk.

The CRA's three penalty tiers

Article 64 of the CRA sets three maximum penalty tiers according to the type of obligation breached.

Tier	Fine cap	What triggers it
1	€15,000,000 or 2.5% of annual worldwide turnover, whichever is higher	Breaching the Annex I essential requirements (product security and vulnerability handling, including the coordinated disclosure policy) and the manufacturer obligations in Articles 13 and 14, among them reporting exploited vulnerabilities and severe incidents to ENISA
2	€10,000,000 or 2% of annual worldwide turnover, whichever is higher	Breaching the obligations of authorized representatives, importers and distributors (Articles 18 to 23), the EU declaration of conformity, CE marking, technical documentation, conformity assessment procedures and notified body obligations
3	€5,000,000 or 1% of annual worldwide turnover, whichever is higher	Supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities in reply to a request

The practical consequence is that the breaches most visible to an authority, such as not reporting an exploited vulnerability or having no CVD policy, sit in the highest tier, not the middle one.

Who can be sanctioned: manufacturers, importers and distributors

The CRA's penalty regime does not only affect the manufacturer. Three actors share responsibility.

Manufacturer: the primary responsible party. It must design the product to meet Annex I, carry out the conformity assessment, issue the EU declaration of conformity and manage vulnerabilities throughout the lifecycle. Most infringements and the severest penalties fall on the manufacturer.

Importer: a company placing products manufactured outside the EU on the European market must verify that the manufacturer completed the conformity assessment, that the product bears the CE marking and that the declaration of conformity is available. The importer can be sanctioned if it places non-compliant products on the market.

Distributor: companies distributing the product on the EU market without being manufacturer or importer must verify the CE marking and that documentation is in order before distribution.

The most likely violations in practice

Violations most likely to generate penalties in the first years of enforcement:

Identical default passwords: having the same factory credentials across all devices of a model is a direct violation of the secure-by-default requirement — the most frequent vulnerability in IoT devices and consumer routers.

No security update process: products with no update mechanism, that charge for security updates, or whose security support cycle is under five years without justification.

Breach of the ENISA notification deadline: failing to notify an actively exploited vulnerability within 24 hours is a top-tier violation and one of the easiest for authorities to verify.

No vulnerability disclosure policy: lacking a published CVD policy and a reporting channel for security researchers is easily verifiable.

Marketing products with known, documented vulnerabilities: if a product has been on the market for months with a vulnerability known in the NVD or ENISA databases and the manufacturer has not published a patch, the market surveillance authority has grounds to open a penalty procedure.

The authorities that can impose sanctions

The CRA is a European regulation, but enforcement and penalties are the responsibility of each Member State's national market surveillance authorities. In Spain, the main market surveillance authority for products with digital elements will be designated by the government (most likely INCIBE or the Secretariat of State for Digitalization). These authorities can: request information from manufacturers, importers and distributors; order the withdrawal of products posing a significant cybersecurity risk; impose corrective measures; and propose and impose administrative sanctions. Products considered to pose a significant risk may be subject to a RAPEX notification (the EU rapid alert system), which can lead to withdrawal from all EU markets simultaneously.

How to reduce the penalty risk

The best protection against the CRA's penalty regime is early and documented compliance. The measures that most reduce penalty risk: completing the conformity assessment before December 11, 2027; having the ENISA notification process operational, as required since September 11, 2026; publishing a CVD policy and a vulnerability reporting channel; maintaining an updated SBOM to respond within hours when a new CVE affecting your dependencies is published; and retaining for 10 years the complete technical documentation evidencing the conformity assessment process.

FAQ

Are CRA penalties cumulative with those under NIS2 or the GDPR?

Yes. The CRA, NIS2 and the GDPR are separate regulations with independent penalty regimes. A security incident involving a product vulnerability can simultaneously trigger CRA penalties (for failing to notify ENISA in time), GDPR penalties (for the resulting personal data breach) and NIS2 penalties (if the affected party is an essential services operator).

Can the CRA generate civil liability toward affected users?

The CRA establishes administrative penalties, not direct civil liability. However, in many Member States non-compliance with regulatory security requirements may be relevant in civil liability proceedings. If a manufacturer places a product knowing it does not meet the CRA requirements and that product is exploited causing harm to a user, non-compliance may be used as evidence of negligence.

Can a startup with limited resources afford CRA compliance?

The CRA is designed to be proportionate to company size. The most demanding assessment procedures (involving notified bodies) only apply to Class II products. For most small-company products, self-assessment is sufficient and the main cost is engineering time to implement the Annex I controls, plus SBOM and dependency vulnerability analysis tooling — which in many cases offer free plans for small projects.

Sources

Assess the CRA risk for my products