Administrative fine
The Cyber Resilience Act has its own three-tier framework of fines. Infringements of the reporting obligation fall into the highest tier. The framework does not apply from the start of the reporting obligation, however, but only from 11 December 2027; from that date, the BSI is also to be the authority for fines in Germany.
An administrative fine is the financial penalty that Article 64 of the Cyber Resilience Act provides for infringements: in the highest tier, up to EUR 15 million or 2.5 per cent of total worldwide annual turnover, whichever is higher.
Definition in the Regulation
Article 64 of Regulation (EU) 2024/2847 sets out three tiers. Paragraph 2: non-compliance with the essential requirements in Annex I or with Articles 13 and 14, and therefore with the reporting obligation too, up to EUR 15 million or 2.5 per cent of total worldwide annual turnover for the preceding financial year. Paragraph 3: non-compliance with other obligations, such as those of importers and distributors, up to EUR 10 million or 2 per cent. Paragraph 4: incorrect, incomplete or misleading information supplied to notified bodies and market surveillance authorities, up to EUR 5 million or 1 per cent. Paragraph 5 lists the criteria for setting the amount, such as the nature, gravity and duration of the infringement and the size of the business. Paragraph 10 exempts microenterprises and small enterprises from fines for missing the 24-hour deadline for the early warning, and open-source software stewards entirely. Under Article 71(2), Article 64 applies only from 11 December 2027; only Article 14 has applied since 11 September 2026.
What it means for manufacturers
The reporting obligation therefore applies for roughly 15 months without fines attached. That is no free pass: the deadlines apply, failures are on record, and market surveillance can demand evidence as soon as it becomes responsible. Medium-sized enterprises have no exemption, and for microenterprises and small enterprises the 72-hour notification and the final report remain subject to fines. In Germany, the BSI is to become the authority for fines (section 70 of the draft BSI Act, BSIG-E), under the draft from 11 December 2027, at the same time as Article 64 (Article 4(4) of the draft); as of 8 October 2026 the draft had not been promulgated. Under Article 64(9), fines may be imposed in addition to corrective measures, withdrawal and recall. No cases of fines under the CRA are known so far.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit