Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 16 min read

Fines and market surveillance under the CRA: amounts, authorities, procedure

Article 64 of Regulation (EU) 2024/2847 sets three tiers of administrative fines, up to EUR 15 million or 2.5 per cent of annual turnover. This page explains which obligations fall into which tier, when the provision applies, what authorities can order besides fines, and who is responsible in Germany and Austria.

Article 64 of the Cyber Resilience Act provides for three tiers of administrative fines. The first goes up to EUR 15 million or 2.5 per cent of worldwide annual turnover and covers breaches of the essential cybersecurity requirements and of the manufacturer obligations, including the reporting obligation under Article 14. The second goes up to EUR 10 million or 2 per cent for the remaining obligations, the third up to EUR 5 million or 1 per cent for supplying incorrect information to authorities. In each case the higher amount applies. Under Article 71(2), however, the provision only applies from 11 December 2027; the reporting obligation has been in force since 11 September 2026 without any fines attached. The powers of market surveillance under Articles 52 to 60 also only apply from that date; they then range from requests for information through corrective action to withdrawal and recall.

Key points

  • Three tiers: EUR 15 million or 2.5 per cent, EUR 10 million or 2 per cent, EUR 5 million or 1 per cent, whichever is higher in each case (Article 64(2) to (4)).
  • Article 64 only applies from 11 December 2027 (Article 71(2)). The reporting obligation has been in force since 11 September 2026 with no fines attached.
  • Microenterprises and small enterprises are exempt only for the 24-hour deadline for the early warning notification; medium-sized enterprises are not exempt at all (Article 64(10)).
  • Fines come on top of corrective action, withdrawal and recall (Article 64(9)).
  • In Germany, the BSI is to become the authority that imposes fines, from 11 December 2027 according to the bill. The act has not yet been promulgated.

Which obligation falls into which tier?

Article 64(1) requires Member States to lay down penalties that are "effective, proportionate and dissuasive". The Regulation itself sets the maximum amounts, graded according to the weight of the obligation:

TierBreach ofMaximum
1 (Article 64(2))Essential cybersecurity requirements in Annex I; manufacturer obligations under Article 13; reporting obligations under Article 14EUR 15,000,000 or 2.5 per cent of total worldwide annual turnover for the preceding financial year, whichever is higher
2 (Article 64(3))Obligations of importers, distributors and authorised representatives (Articles 18 to 23); Article 28; Article 30(1) to (4); Article 31(1) to (4); Article 32(1) to (3); Article 33(5); rules for notified bodies (Articles 39, 41, 47, 49); providing data and documentation to market surveillance (Article 53)EUR 10,000,000 or 2 per cent
3 (Article 64(4))Incorrect, incomplete or misleading information supplied to notified bodies and market surveillance authoritiesEUR 5,000,000 or 1 per cent

A late or missing early warning, notification or information to users therefore falls into tier 1, the highest. Giving the authority incorrect information to buy time is, in addition, a separate offence under tier 3.

How is a fine calculated?

The maximum amounts are not standard rates. Article 64(5) sets out the criteria: the nature, gravity, duration and consequences of the infringement; earlier fines imposed by other authorities for similar infringements; the size of the business, expressly including microenterprises and small and medium-sized enterprises, start-ups among them; and market share. Paragraph 9 makes clear that fines can be imposed in addition to corrective and restrictive measures; a recall does not replace the administrative fine. Whether turnover means group turnover has not been settled for the CRA.

Who is exempt?

Article 64(10) contains two exemptions. Microenterprises and small enterprises are not fined if they miss the 24-hour deadline for the early warning (Article 14(2), point (a), and Article 14(4), point (a)). Open-source software stewards are not fined for any infringement. Recital 120 adds that in both cases Member States should not impose any other kinds of penalties with pecuniary character either. In the original Official Journal text, paragraph 10 began "By way of derogation from paragraphs 3 to 9", even though the early warning falls under paragraph 2; the corrigendum of 2 July 2025 (OJ L 2025/90555) changed this to "By way of derogation from paragraphs 2 to 9". The exemption for the 24-hour deadline is therefore expressly in the text.

The exemption is narrow. It covers only the 24 hours; the 72-hour notification and the final report remain subject to fines for microenterprises and small enterprises too. And it does not apply to medium-sized enterprises. The thresholds come from Recommendation 2003/361/EC, to which Article 3, point (19), refers: microenterprises have fewer than ten employees and turnover or a balance sheet total of up to EUR 2 million, small enterprises fewer than 50 employees and up to EUR 10 million. A machinery manufacturer with 80 employees is at least a medium-sized enterprise and has no exemption, although its size remains a factor in setting the fine under paragraph 5.

When does Article 64 apply?

Article 71(2) staggers the dates of application: Chapter IV on notified bodies (Articles 35 to 51) has applied since 11 June 2026, Article 14 since 11 September 2026, and everything else from 11 December 2027. Article 64 falls into this last group. Breaches of the reporting obligation before 11 December 2027 are therefore not subject to fines under Article 64 (see the timeline).

This reading is shared by Bitkom, the Vienna law firm E+H Rechtsanwälte and ITMR Legal; Bitkom speaks of around 15 months of reporting obligation without the threat of fines. The law firm Goodwin wrote the opposite on 11 September 2026, stating that breaches of the reporting obligation would expose manufacturers to fines of up to EUR 15 million from that day; Crowell & Moring writes that the reporting obligation is enforceable with immediate effect, without mentioning fines. The text of the Regulation supports the first reading, as does the Commission services' FAQ (as of 4 September 2026), according to which the rules on market surveillance and enforcement apply from 11 December 2027. In Germany, moreover, the draft implementation act would make the BSI the authority for fines only from that date.

That does not mean nothing counts until then. The reporting obligation has applied since 11 September 2026, and anything missed since then remains visible in the records an authority may later request. Failures that were complete before 11 December 2027 cannot, however, be penalised retrospectively: Article 64 only applies from that date, as the Commission also states in its FAQ, and a fine requires that the penalty was already laid down by law at the time of the act (section 3 of the German Act on Regulatory Offences, Gesetz über Ordnungswidrigkeiten or OWiG, and Article 49(1) of the EU Charter of Fundamental Rights). Later scrutiny and retrospective penalties are two different things. Two points remain open. First, failures that continue beyond that date, such as a notification that is never made: if the penalty changes while the act is ongoing, section 4(2) OWiG applies the law in force when the act ends; no source on the CRA discusses whether a missed notification continues in this sense. Second, the legal basis on which an authority can request reporting records for products placed on the market before 11 December 2027, to which, under Article 69(3), only the reporting obligation applies. The market surveillance provisions (Articles 52 to 60) likewise only apply from 11 December 2027 under Article 71(2).

What market surveillance can do besides fines

Market surveillance means the checks that public authorities carry out on products on the market. In the EU it is governed by Regulation (EU) 2019/1020, which also applies here under Article 52(1) CRA. Each Member State designates the authorities for it (Article 52(2)). Like Article 64, Articles 52 to 60 apply from 11 December 2027 (Article 71(2)). The authorities can call on the coordinating CSIRTs and ENISA for technical advice (Article 52(5)), and they cooperate with the data protection authorities (Article 52(7)). The tools:

  • Access to data and documentation (Article 53): on a reasoned request, including internal documents. This includes the record showing when you became aware and when you notified. Article 13(22) requires manufacturers to provide this and to cooperate.
  • Corrective action, withdrawal, recall (Article 54): where there is a significant cybersecurity risk, the authority evaluates the product, with the CSIRT where necessary. It then requires corrective action within a reasonable period "to bring the product with digital elements into compliance with those requirements, to withdraw it from the market, or to recall it". Withdrawal means the product is no longer made available. Recall means getting products back from users. If the manufacturer does nothing, provisional measures follow, up to a prohibition, with a three-month period for the Commission and Member States to raise objections (paragraph 8). The manufacturer's procedural rights come from Article 18 of Regulation (EU) 2019/1020.
  • Union-level procedure (Articles 55 and 56): if objections are raised, the Commission decides within nine months; it can also order withdrawal or recall itself (Article 56(5)).
  • Compliant products presenting a significant risk (Article 57) and formal non-compliance (Article 58), such as missing CE marking, a defective declaration of conformity or incomplete technical documentation, can likewise lead to withdrawal or recall.
  • Sweeps (Article 60): "simultaneous coordinated control actions" by several authorities on particular products, including inspections of products "acquired under a cover identity", in other words covert test purchases. ENISA can propose product categories for sweeps on the basis of notifications under Article 14 (paragraph 3).

Article 65 adds that consumer organisations can bring representative actions under Directive (EU) 2020/1828 for infringements that harm the interests of consumers. Recital 31 also refers to product liability. A sales ban or a recall hits a manufacturer's business directly, usually harder than a fine.

Who is responsible in Germany?

The Regulation applies directly, but each Member State designates its own authority. In Germany this is to be settled by the government bill of 26 May 2026 (Bundestag printed paper 21/6134), which adds sections 65 to 70 to the BSI Act (BSIG). After its first reading on 11 June 2026 it was referred to the Bundestag's Committee on Internal Affairs (Innenausschuss), and as of 8 October 2026 it has not been promulgated. Under Article 4(4) of the bill, the provisions on market surveillance and fines are to enter into force only on 11 December 2027, even if the act is promulgated earlier, and so at the same time as Article 64. The status of the bill and the criticism of it are described in the guide to the German CRA implementation act. For fines and market surveillance, the bill provides:

  • Section 65 of the draft BSI Act (BSIG-E): the BSI is the national market surveillance authority, cooperates with the federal and state market surveillance authorities and handles complaints from consumers.
  • Sections 66 and 67: the BSI is the notifying authority; it supports SMEs and open-source stewards with training and a regulatory sandbox.
  • Section 69: for infringements under Article 64(2) to (4), the Act on Regulatory Offences applies accordingly, except for section 17 and section 30(1) and (2) OWiG, because, according to the explanatory memorandum, the Regulation's penalty rules are exhaustive and take precedence in this respect.
  • Section 70: the BSI is the administrative authority within the meaning of section 36(1) no. 1 OWiG for Article 64(2) to (4). No fines are imposed on public authorities and public bodies.

Before 11 December 2027, therefore, there is no authority in Germany that could impose a CRA fine, even if the act is promulgated earlier. Personal responsibility: section 69 BSIG-E excludes only section 17 and section 30(1) and (2) OWiG. The provisions on acting on behalf of another (section 9 OWiG) and on breach of supervisory duties in businesses and companies (section 130 OWiG) therefore apply accordingly. Whether authorities will use them to pursue managing directors personally, and whether section 130 OWiG applies at all alongside the Regulation's penalty rules, is open. Limitation period: the bill has no rule of its own and does not exclude section 31 OWiG. On the wording of the statute, prosecution is then time-barred after three years (section 31(2) no. 1 OWiG, for a maximum fine above EUR 15,000), counted from the end of the act (section 31(3) OWiG), but at the latest six years after that point (section 33(3) OWiG). When an omission such as a notification that was never made comes to an end is open; for the CRA, no authority and no commentary has yet confirmed this calculation.

Who is responsible in Austria?

The coordinating CSIRT for notifications under Article 14 is CERT.at. The notifying authority sits within the Austrian Federal Chancellery (Bundeskanzleramt). Market surveillance, penalties and procedures have not yet been determined; the Federal Chancellery states that further responsibilities will be set in the coming months as part of implementing the Cyber Resilience Act. As of 8 October 2026 there is no evidence of a national act or bill. The fines in Article 64 also apply directly in Austria, from 11 December 2027. More in the guide The CRA in Austria and Switzerland.

Common mistakes

  • "As an SME, we are exempt." Only microenterprises and small enterprises are exempt, and only for the 24-hour deadline. Medium-sized enterprises have no exemption.
  • "Nothing counts until December 2027." Fines and market surveillance only take effect from 11 December 2027, but the reporting obligation has applied since 11 September 2026. Anything missed since then cannot be made up and remains visible in the records an authority may later request.
  • Giving incorrect information to buy time. A separate offence carrying up to EUR 5 million or 1 per cent (Article 64(4)).
  • Looking only at the fine. Withdrawal, recall, representative actions and product liability come on top (Article 64(9), Article 65).

The first thing an authority will ask for after a late notification is the evidence: when the report arrived, when the assessment was complete, who was alerted, when the notification was submitted. CRA Response Center keeps this history as part of your readiness: receipt with a timestamp, who was notified when and who took the case on, and the deadlines from the confirmed time of awareness. The manufacturer submits the notification itself.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

How high is the fine for a late notification?

An infringement of Article 14 falls into tier 1: up to EUR 15 million or 2.5 per cent of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 64(2)). That is the maximum; the actual amount is set according to paragraph 5.

Can fines be imposed today?

Under Article 71(2), Article 64 only applies from 11 December 2027. Some law firms read this differently; the text of the Regulation supports the first reading, as does the Commission services' FAQ. In Germany, moreover, the draft implementation act would make the BSI the authority for fines only from that date.

Is senior management personally liable?

For undertakings, Article 64 bases the maximum on turnover; recital 121 assumes that fines can also be imposed on persons that are not undertakings. The German bill excludes only section 17 and section 30(1) and (2) OWiG; acting on behalf of another (section 9 OWiG) and breach of supervisory duties (section 130 OWiG) therefore apply accordingly. Whether authorities will use these to pursue management personally, and whether section 130 OWiG applies alongside the Regulation's penalty rules, is open. What follows from general company or liability law cannot be answered from these sources; that is a question for your lawyers.

Who imposes the fine in Germany?

Under the draft implementation act, the BSI (section 70 BSIG-E), in proceedings under the Act on Regulatory Offences. According to the bill, this responsibility is to enter into force only on 11 December 2027 (Article 4(4)); until then there is no competent authority.

Can my product be taken off the market?

Yes, from 11 December 2027. Where there is a significant cybersecurity risk, market surveillance can require corrective action, withdrawal or recall (Article 54), and likewise for formal non-compliance (Article 58), in some circumstances even for a compliant product (Article 57). This comes on top of any fine (Article 64(9)).

What are sweeps?

Simultaneous, coordinated checks by several authorities on a product category, including covert test purchases (Article 60). ENISA can use the notifications to propose which categories should be checked. Whether and when this will first happen is open.

When does an infringement become time-barred?

The bill does not regulate this specifically, but applies the OWiG accordingly and does not exclude section 31 OWiG. On the wording of the statute, that means three years from the end of the act (section 31(2) no. 1 and (3) OWiG), at most six years (section 33(3) OWiG). No authority or commentary on the CRA has confirmed this so far.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days