What specific violations trigger administrative fines and penalties under CRA Article 64?

Article 64(2) establishes the highest administrative penalty tier, capping fines at €15,000,000 or 2.5% of total worldwide annual turnover in the preceding financial year, whichever is higher.^[1]

This tier applies directly to three critical areas:

1. Essential cybersecurity requirements set out in Annex I Part I (security properties including secure default configurations, access protection, and data confidentiality).
2. Vulnerability handling obligations set out in Annex I Part II (software bill of materials, coordinated vulnerability disclosure, and security update mechanisms).
3. Manufacturer obligations under Article 13 and statutory reporting obligations under Article 14 (submitting the 24-hour early warning and 72-hour notification for actively exploited flaws).

Article 64(3) sets mid-tier fines of up to €10,000,000 or 2% of global annual turnover for procedural and technical documentation violations.^[1]

Key triggers include:

1. Failure to draw up and maintain technical documentation under Article 31 and Annex VII.^[2]
2. Failure to draw up or update an EU Declaration of Conformity under Article 28, or placing CE marking without completing conformity assessment.^[3]
3. Non-compliance with conformity assessment procedures under Article 32 (for instance, conducting internal self-assessment when a notified body is mandatory).
4. Violations of importer obligations under Article 19 or distributor obligations under Article 20.

Article 64(4) imposes fines of up to €5,000,000 or 1% of global annual turnover for supplying incorrect, incomplete, or misleading information to market surveillance authorities or notified bodies.^[1]

Market surveillance relies on verifiable technical documentation and honest disclosures. Providing fabricated risk assessments, incomplete SBOMs, or misleading mitigation claims constitutes a separate statutory violation under this tier, in addition to any underlying substantive failure.