Cyber Resilience Act Response Center Request a demoDemo

News Updated

Fines under the CRA only apply from 11 December 2027

Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities. Some articles claim that fines have been possible since then as well. The text of the Regulation says otherwise: Article 64 only applies from 11 December 2027. Here is what applies in the meantime.

The reporting obligation under Article 14 of Regulation (EU) 2024/2847 has applied since 11 September 2026. Its start prompted numerous articles from law firms and industry associations, and they contradict each other on one point: whether breaches of the reporting obligation can already be punished with fines. The answer lies in Article 71(2) of the Regulation. Under that provision, Chapter IV on notified bodies has applied since 11 June 2026, Article 14 since 11 September 2026, and everything else from 11 December 2027. Article 64, which governs administrative fines, falls under "everything else". The fines regime therefore only applies from 11 December 2027. Between the two dates lie around 15 months in which the reporting obligation applies without being backed by fines.

This reading is shared by an article from it-daily with the German digital industry association Bitkom of 11 September 2026, the law firm ITMR Legal on 6 August 2026 and the Vienna law firm E+H Rechtsanwälte on 10 September 2026. Goodwin takes a different view: on 11 September 2026 the law firm wrote that breaches of the reporting obligation could be fined from that day on, and Crowell & Moring considered the reporting obligation enforceable with immediate effect on the same day. We follow the text of the Regulation. In addition, in Germany the authority that is to impose fines has not yet been designated, because the German CRA implementation act (CRA-Durchführungsgesetz) has not been promulgated. The draft (Bundestag printed paper 21/6134) names the BSI as the authority responsible for fines.

What it means for manufacturers

The relief is smaller than it sounds. Four points matter:

  • The deadlines apply. Since 11 September 2026, the Regulation has required manufacturers to send an early warning of actively exploited vulnerabilities within 24 hours of becoming aware of them, followed by a vulnerability notification within 72 hours and a final report (Article 14(2)). The fact that a breach cannot currently be fined does not change the obligation. Notifications go to the coordinating CSIRT and to ENISA; in Germany, to CERT-Bund at the BSI.
  • The ceiling remains high. From 11 December 2027, Article 64(2) provides for administrative fines of up to EUR 15 million or 2.5 per cent of total worldwide annual turnover for breaches of manufacturers' obligations. For microenterprises and small enterprises, Article 64(10) exempts failure to meet the 24-hour deadline from fines; all other obligations remain.
  • The record already counts. If you report today, you leave a record with time stamps at the CSIRT and at ENISA. If you do not, you leave a gap. The Regulation does not say whether market surveillance authorities will later take up failures from the period before December 2027. Either way, a complete record of awareness, assessment and notification puts you in a better position.
  • Customers and contractual partners will not wait. The obligation to inform impacted users under Article 14(8) has also applied since September 2026.

How market surveillance is organised and who will be responsible in Germany is explained in the guide Fines and market surveillance under the CRA; the Regulation's key dates are set out in the Cyber Resilience Act timeline.

For your readiness, this means: the 15 months without a fines regime are the time in which the call chain, reporting address and record-keeping can bed in during day-to-day operations, without a mistake leading to a fine. CRA Response Center keeps you ready from day one as if the fines regime already applied, because the deadlines do.

What remains open

The differing readings of individual law firms have not been settled by any court. It remains open when the German implementation act will be promulgated and whether the Bundestag will change anything in the fines section of the draft. It is also open how market surveillance authorities will deal with failures from the period before December 2027. As of 7 October 2026, no enforcement or fine cases had become known, nor had any notifications from the ENISA platform been published.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days