What the Cyber Resilience Act fines
Article 64 sets three ceilings. Each is a fixed sum or a share of worldwide annual turnover, whichever is higher, so the percentage is what binds a large company and the sum is what binds a small one. The rules themselves are national: each member state lays down its own penalties within these limits and its own market surveillance authority applies them.Art. 64(1)
€15 million
or 2.5% of turnover
The essential cybersecurity requirements in Annex I, and the manufacturer obligations in Articles 13 and 14Art. 64(2)
The reporting duty is Article 14. Missing a filing sits in the top band.
€10 million
or 2% of turnover
The remaining operator obligations: importers, distributors, authorised representatives, conformity assessment bodies and the rest of the list in paragraph 3Art. 64(3)
The band for everyone in the supply chain who is not the manufacturer.
€5 million
or 1% of turnover
Supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities in reply to a requestArt. 64(4)
A separate offence from the underlying one. A wrong answer to an authority costs on its own.
What the authority weighs
The ceilings are ceilings. Paragraph 5 lists what decides the actual amount: the nature, gravity and duration of the infringement and its consequences; whether the same operator has already been fined for a similar one; and the size of the operator, with express regard to microenterprises, small and medium-sized enterprises and start-ups, and its market share.Art. 64(5)
Size is a factor, not an exemption. A twenty-person vendor is not fined as a multinational would be, and it is still fined. What reduces the exposure is the same thing that reduces the fine: a reporting process that ran, with the evidence that it did.
Who is not fined
Open-source software stewards are outside the administrative fines entirely.Art. 64(10) Whether a public authority can be fined is left to each member state.
From when
The reporting duty applies from 11 September 2026 and the Regulation as a whole from 11 December 2027.Art. 71(2) Article 64 is not among the provisions brought forward, and the penalty rules are national, so whether and how a missed report before December 2027 is penalised is a question for the member state concerned and for your counsel. Do not read a grace period into that sentence; nothing in the Regulation grants one, and the duty itself is in force.
The only defence is the record
Every filing Declara produces comes with a timestamped, hash-chained evidence pack that anyone can verify without an account. If a question is ever asked, that is the answer.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.