What the Cyber Resilience Act fines are, and what else can happen

Fines are the part of the Cyber Resilience Act people ask about first, and the part that decides least. The Act sets three bands, each with a ceiling, and it tells the authority what to weigh before it goes anywhere near one. This is what each band covers, what brings a fine down, and the consequences that arrive without one.

Three bands, each for a different failure

National authorities enforce the Act. National market surveillance authorities enforce the Regulation and can require corrective action, restrict or prohibit a product's availability, or order its withdrawal or recall.[Chapter V] The maximum fines, though, are written into the Act itself, and they come in three bands.

The largest band is for the core of the law: the product security requirements, the manufacturer's own duties, and reporting.

Failing to meet the essential cybersecurity requirements in Annex I, or the manufacturer obligations in Article 13, or the reporting obligations in Article 14, can be fined up to 15 million euro — or, if the offender is a business, up to 2.5% of its total worldwide annual turnover for the previous financial year, whichever is higher. This is the band a missed report falls into. Since the correction of 2 July 2025 this band is also the one the carve-out in Article 64(10) reaches, so check the carve-out for micro and small enterprises before assuming it applies.[Art. 64(2); Art. 64(10) as corrected now reaches this paragraph]

The middle band is for a closed list of duties — the declaration of conformity and the technical documentation, the CE marking, the conformity assessment, and the duties of representatives, importers and distributors.

A second band of up to 10 million euro — or, if the offender is a business, up to 2% of its total worldwide annual turnover for the previous financial year, whichever is higher — applies to a closed list of provisions, not to the Regulation as a whole. For a manufacturer the ones that can bite are the rules on authorised representatives, importers and distributors and on when a manufacturer's duties transfer (Articles 18 to 23), the EU declaration of conformity (Article 28), CE marking (Article 30(1) to (4)), technical documentation (Article 31(1) to (4)), conformity assessment (Article 32(1) to (3)) and correct use of the simplified documentation form (Article 33(5)). The rest of the list is aimed at notified bodies and at giving authorities access to data and documents. No fine in this band may be imposed on an open-source software steward either. That limb is not something the correction of 2 July 2025 brought about: this band is paragraph 3, and paragraph 3 was already inside the carve-out as the Act was first published. What the correction changed is the top band at paragraph 2, and the carve-out for micro and small enterprises that goes with it.[Art. 64(3); Art. 64(10)(b), which reaches this band in the text as first published as well as in the corrected text, because the original carve-out already ran from paragraph 3]

The smallest band is for what you tell an authority when it asks.

Supplying incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request can be fined up to 5 million euro — or, if the offender is a business, up to 1% of its total worldwide annual turnover for the previous financial year, whichever is higher. It is the answer to a request that is caught, and only those two kinds of recipient.[Art. 64(4)]

Ceilings, not prices

These amounts are ceilings, not tariffs. In setting the amount in an individual case the authority must take account of all the relevant circumstances and give due regard to the nature, gravity and duration of the infringement and its consequences, to any fine already applied by the same or another authority for a similar infringement, and to the size and market share of the operator — with microenterprises, small and medium-sized enterprises and start-ups named expressly.[Art. 64(5)]

In practice that means an authority looks at what went wrong, for how long, what it caused and who you are before it decides anything. A reporting process that exists, has an owner and has been rehearsed is evidence on every one of those points. So is a component list that comes out of your build, and a written record of the decisions you took and why. None of it guarantees an outcome; all of it is what an authority reads first.

The carve-out for the smallest companies

As the Act was corrected in July 2025, no administrative fine applies to a manufacturer that counts as a microenterprise or a small enterprise for missing the 24-hour deadline on an early warning — either about a weakness under attack or about a serious incident. Because the correction moved the carve-out to start at paragraph 2, it reaches the largest band, 15 million euro or 2.5% of worldwide turnover, which is where a reporting failure sits; before the correction it did not. Read the limits with it: the two 24-hour early warnings only, not a failure to report at all and not the 72-hour notification or the final report; microenterprises and small enterprises only, not medium-sized ones; and it removes the fine, not the duty, so an authority can still order corrective or restrictive measures and a customer or importer will still ask. A second limb of the same paragraph covers open-source software stewards, and it is wider: no administrative fine at all, for any breach of the Act.[Art. 64(10) as corrected by OJ L, 2025/90555, 2.7.2025 ("paragraphs 2 to 9"); Art. 64(10)(a) with Art. 14(2)(a) and Art. 14(4)(a); Art. 64(10)(b) for stewards; Art. 64(2) for the band now reached; Art. 64(9) for fines sitting alongside corrective and restrictive measures]

Read that carefully before relying on it. It covers the first early warning only, it covers microenterprises and small enterprises only, and it removes the fine rather than the duty. A late notification, a missing final report or a report never filed at all is not covered, and neither is a medium-sized company.

What happens that is not a fine

An authority can act on the product itself: require corrective action, restrict or prohibit it, or order a withdrawal or a recall. For a company that sells one product family, that is a larger risk than any fine.

A customer can sue. The new product liability rules count software as a product, and missing security updates as a possible defect.

Directive (EU) 2024/2853, the new Product Liability Directive, counts software as a product. A maker cannot escape a claim by saying the fault only appeared after the product was sold, where the fault comes from the software itself, or from missing software updates needed to keep the product safe, and those were within the maker's control. Cybersecurity requirements count when a court decides whether a product was safe enough. The Directive does not itself oblige anyone to supply updates, and it does not cover free and open-source software developed or supplied outside a commercial activity.[Title; Art. 4(1); Art. 7(1) and 7(2)(f); Art. 11(2)(b) and (c); Art. 2(2); recital 51, last sentence (the Directive imposes no obligation to provide updates or upgrades)] The new Product Liability Directive applies to products placed on the market or put into service after 9 December 2026, the date by which Member States must transpose it. Anything placed on the market before that date stays under the 1985 Directive it replaces.[Art. 2(1); Art. 22(1); Art. 21 (Directive 85/374/EEC repealed with effect from the same date but kept for products placed on the market before it)]

Your buyers will ask. Importers, distributors and larger customers are checking their suppliers now, because the Act gives them duties of their own. A supplier who cannot answer loses the order long before any authority is involved.

Which duty applies first

The first duty that can be enforced is reporting, because it is the only product duty already in force. Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] It covers products you have already sold as well as new ones. Products placed on the market before 11 December 2027 fall under the essential requirements only if they are substantially modified from that date onwards, but the Article 14 reporting obligations are expressly carved out of that relief and apply to every product in scope that was placed on the market before then. From 11 September 2026 the reporting duty therefore covers a manufacturer's whole installed base, not only what it sells from now on.[Art. 69(2), 69(3)] The rest of the Act follows.

The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)]

The checklist

• You know which band each likely failure falls in, starting with a missed or late report.
• Your reporting process has a named owner and a deputy, and it has been rehearsed once.
• A component list comes out of your build for every supported release.
• Decisions about vulnerabilities are written down, with the reason.
• You know whether you count as a micro or small enterprise, and what that does and does not change.
• Your product liability insurance has been read with software in mind.

If you want help

If you are not certain the Act reaches what you make, settle that first: our scope check takes eight short steps and tells you whether the Cyber Resilience Act applies to your product, which duties are yours, and the article behind each answer — free, in about two minutes. It is our engineering reading of the law, not a legal ruling.

The reporting process above is the core of our Reporting Ready package, and every price is on the pricing page.