CRA Enforcement: What Happens If You Don’t Comply
The CRA has teeth. Non-compliance means your products can be removed from the EU market, and fines can reach €15 million. Understanding enforcement helps you prioritize compliance efforts.
Penalty Structure
| Violation | Maximum Fine |
|---|---|
| Essential cybersecurity requirements | €15M or 2.5% global annual turnover |
| Other CRA obligations | €10M or 2% global annual turnover |
| Incorrect/misleading information to authorities | €5M or 1% global annual turnover |
For each violation, the higher amount applies.
Market Surveillance
Member state authorities will conduct:
Reactive Surveillance
- Respond to vulnerability reports and incidents
- Investigate complaints from users or competitors
- Follow up on ENISA vulnerability notifications
Proactive Surveillance
- Random product testing and audits
- Verification of CE marking and documentation
- SBOM completeness checks
- Security testing of products on the market
What Authorities Can Do
- Request documentation — technical files, SBOMs, test reports
- Order product testing — at the manufacturer’s expense
- Require corrective action — fix vulnerabilities, update documentation
- Issue product recalls — remove non-compliant products from the market
- Ban market access — prevent future sales until compliance is achieved
- Impose fines — up to the maximum amounts above
How to Prepare for Inspection
Compliance Package (ready at all times):
├── EU Declaration of Conformity
├── Technical Documentation
│ ├── Product description
│ ├── Security risk assessment
│ ├── Design and development documentation
│ └── Test reports
├── Current SBOM
├── Vulnerability handling procedures
├── Security update policy and history
├── Incident reports filed with ENISA
└── Evidence of security testingRisk-Based Prioritization
Focus compliance efforts where enforcement risk is highest:
- Products involved in security incidents — these attract immediate attention
- Products with known unpatched vulnerabilities — visible in public databases
- Products without CE marking — easy to identify and enforce
- Class II/Critical products — higher scrutiny by design
Concerned about CRA enforcement? I help organizations build audit-ready compliance programs. Get in touch.
