"Up to 15 million euro" is the number every article about the Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") quotes. For a company with three people and one product, that number says very little. This guide explains the three tiers of fines, the one exemption for micro and small companies, how the amount is set, and the measure that can hurt a small company more than a fine: losing the right to sell the product.
The three tiers
Member States set the rules on penalties, which must be "effective, proportionate and dissuasive" (Art. 64(1)). The CRA sets the maximum administrative fines:
| Tier | What it covers | Maximum fine | Basis |
|---|---|---|---|
| 1 | Essential cybersecurity requirements (Annex I) and the manufacturer's obligations in Articles 13 and 14 - including vulnerability handling, support period and reporting | 15 million EUR or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher | Art. 64(2) |
| 2 | Other obligations, among them those of authorised representatives, importers and distributors (Art. 18-23), the EU declaration of conformity (Art. 28), CE marking (Art. 30), technical documentation (Art. 31), conformity assessment (Art. 32) | 10 million EUR or 2%, whichever is higher | Art. 64(3) |
| 3 | Supplying incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request | 5 million EUR or 1%, whichever is higher | Art. 64(4) |
Note the wording: "whichever is higher". For a micro company, 2.5% of turnover is a small amount, so the legal ceiling is the fixed 15 million EUR. The ceiling is not the starting point, though.
How the amount is decided
When an authority decides on a fine, it must take into account all relevant circumstances of the case, and in particular (Art. 64(5)):
- the nature, gravity and duration of the infringement and its consequences;
- whether the same operator has already been fined by other market surveillance authorities for a similar infringement;
- the size, in particular for microenterprises, SMEs and start-ups, and the market share of the operator.
So the CRA tells authorities to scale the fine to the company. A missed report on a minor flaw at a two-person firm is not the same case as a large vendor ignoring an exploited vulnerability for months.
How much an authority will actually impose: no data. No national fining practice under the CRA existed yet to our knowledge in October 2026, and fines only apply from December 2027 (see below).
The micro and small company exemption
The CRA has one clear relief. Administrative fines do not apply to "manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a)" (Art. 64(10)(a)). These are the 24-hour early warnings for actively exploited vulnerabilities and severe incidents.
What the exemption does not cover:
- the duty to report itself - it stays;
- the 72-hour notification (Art. 14(2)(b) and 14(4)(b));
- the final report after 14 days or one month (Art. 14(2)(c) and 14(4)(c));
- the duty to inform your users (Art. 14(8));
- all other requirements: Annex I, support period, documentation, CE marking.
Who is micro or small? The EU definition (Commission Recommendation 2003/361/EC): a microenterprise has fewer than 10 staff and an annual turnover or balance sheet total of no more than 2 million EUR; a small enterprise has fewer than 50 staff and no more than 10 million EUR. If you belong to a larger group, the group's figures may count.
Open-source software stewards - foundations and similar bodies that support open-source projects without being their manufacturer - cannot be fined at all under the CRA (Art. 64(10)(b)).
When fines start
Article 71(2) lists the parts of the CRA that apply early: Article 14 (reporting, from 11 September 2026) and Chapter IV (notified bodies, from 11 June 2026). Article 64 is not among them, so the CRA's fine regime applies from 11 December 2027.
That is not a reason to ignore reporting until then. The duty in Article 14 applies today, and a product that becomes the subject of an investigation in 2028 will be judged with its history.
What can hurt more than a fine
The CRA uses the EU market surveillance framework (Regulation (EU) 2019/1020, Art. 52). If an authority finds that your product presents a significant cybersecurity risk, it can require you to take all appropriate corrective action to bring it into compliance, to withdraw it from the market or to recall it, within a reasonable period it sets according to the risk (Art. 54). If you do not act, the authority can take provisional measures to prohibit or restrict the product on its national market (Art. 54(5)). Fines can be imposed in addition to these measures (Art. 64(9)).
For a company with one product, a withdrawal order means no revenue - regardless of the size of any fine.
A sober risk check
| Situation | What it costs you |
|---|---|
| You miss the 24-hour early warning, but send the 72-hour notification and final report | No CRA fine for a micro or small company (Art. 64(10)(a)) |
| You do not report an actively exploited vulnerability at all | Tier 1, up to 15 million EUR; the amount scaled to your size (Art. 64(2) and 64(5)) |
| From 11 December 2027: no technical documentation or no EU declaration | Tier 2, up to 10 million EUR (Art. 64(3)) |
| Product presents a significant risk and is not fixed | Corrective action, withdrawal or recall (Art. 54), possibly plus a fine (Art. 64(9)) |
The cheapest protection is boring: know what is inside your product, watch for exploited vulnerabilities every day, and have the 72-hour notification ready to go. More on that in CRA 24-hour reporting and the full CRA timeline.
Not sure where you stand?
First make sure the CRA applies to you at all: Does the CRA apply to your product? Or take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes, result and checklist by e-mail. Take the free check
If the CRA applies to you, Earlybell does this work every week: SBOM with every release, a daily check of your dependencies, ready-to-send drafts of the 24-hour and 72-hour reports for you to submit, and an up-to-date disclosure policy and security.txt. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act). It is not legal advice. Article numbers refer to that Regulation. National rules on penalties may add details.