CRA Enforcement: Penalties and Compliance

CRA Enforcement: What Happens If You Don’t Comply

The CRA has teeth. Non-compliance means your products can be removed from the EU market, and fines can reach €15 million. Understanding enforcement helps you prioritize compliance efforts.

Penalty Structure

For each violation, the higher amount applies.

Market Surveillance

Member state authorities will conduct:

Reactive Surveillance

• Respond to vulnerability reports and incidents
• Investigate complaints from users or competitors
• Follow up on ENISA vulnerability notifications

Proactive Surveillance

• Random product testing and audits
• Verification of CE marking and documentation
• SBOM completeness checks
• Security testing of products on the market

What Authorities Can Do

1. Request documentation — technical files, SBOMs, test reports
2. Order product testing — at the manufacturer’s expense
3. Require corrective action — fix vulnerabilities, update documentation
4. Issue product recalls — remove non-compliant products from the market
5. Ban market access — prevent future sales until compliance is achieved
6. Impose fines — up to the maximum amounts above

How to Prepare for Inspection

Compliance Package (ready at all times):
├── EU Declaration of Conformity
├── Technical Documentation
│   ├── Product description
│   ├── Security risk assessment
│   ├── Design and development documentation
│   └── Test reports
├── Current SBOM
├── Vulnerability handling procedures
├── Security update policy and history
├── Incident reports filed with ENISA
└── Evidence of security testing

Risk-Based Prioritization

Focus compliance efforts where enforcement risk is highest:

1. Products involved in security incidents — these attract immediate attention
2. Products with known unpatched vulnerabilities — visible in public databases
3. Products without CE marking — easy to identify and enforce
4. Class II/Critical products — higher scrutiny by design

Concerned about CRA enforcement? I help organizations build audit-ready compliance programs. Get in touch.