Cyber Resilience Act penalties: what products are in scope now?

TL;DR: Cyber Resilience Act penalties can reach €15 million or 2.5% of worldwide annual turnover, while reporting duties begin on 11 September 2026 and apply to products already shipped, according to Finite State. The compliance problem is not the headline fine table but proving what is in the installed base before reporting clocks start.

Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “Cyber Resilience Act Fines and Penalties: What Non-Compliance Actually Costs”.

By the numbers:

• Non-compliance can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
• Article 64 sets three penalty tiers at €15 million or 2.5%, €10 million or 2%, and €5 million or 1%.

Key questions

Q: What breaks when CRA reporting is not operational before 2026?

A: Teams lose the ability to produce a defensible report inside the first deadline window, because they still need to identify affected products, confirm exploitation, gather evidence, and route approvals.

Q: Why do legacy products create CRA risk before the main deadline?

A: Legacy products remain in scope for reporting obligations even when older market placements are grandfathered from some essential requirements.

Q: What do security teams get wrong about CRA fines and recalls?

A: They focus on the euro amount and miss the operational impact of withdrawal or recall.

Practitioner guidance

• Map every shipped product to its CRA scope and tier Build a product register that ties each model and firmware line to Annex I exposure, reporting obligations, and responsible owners.
• Stand up a reporting workflow before 11 September 2026 Create an incident-to-report path that can produce early warning, vulnerability notification, and final report outputs without waiting for full forensic closure.
• Reconcile SBOMs to shipped binaries Verify that the SBOM reflects the actual image deployed in the product, then tie that record to provenance, support status, and customer impact analysis.

Bottom line: The article shows that CRA exposure is driven by shipped product reality, not just future development plans.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →