What the CRA does and does not punish

"The Cyber Resilience Act fines manufacturers for security flaws in their products." People say that about the CRA (Regulation (EU) 2024/2847), and the Regulation does not say it. The CRA fines a missing duty, not the existence of a flaw. A vulnerability turning up in a product you shipped is not, on its own, an infringement; what you did before it turned up, and what you do next, is what the Regulation asks about. This guide is a documentation aid, not legal advice.

What can be fined

Article 64 sets three tiers, as our glossary row penalties records them.

Paragraph	What it attaches to	Ceiling
Article 64(2)	The Annex I essential cybersecurity requirements, and the manufacturer's obligations in Articles 13 and 14	Up to €15 million or 2.5%
Article 64(3)	Other listed obligations, among them the EU declaration of conformity rules in Article 28	Up to €10 million or 2%
Article 64(4)	Incorrect, incomplete or misleading information given to a notified body or a market surveillance authority in reply to a request	Up to €5 million or 1%

Each percentage is of total worldwide annual turnover for the previous financial year; the higher of the two applies. These are ceilings, set by each Member State, not set amounts: each country lays down its own penalty rules (Article 64(1)), and the authority weighs the circumstances of the case, including the size of the company (Article 64(5)).

No row says "a vulnerability was found". The first does reach the product itself, through Annex I.

What a vulnerability in a shipped product means

At release. Annex I, Part I, point 2(a) asks that a product be "made available on the market without known exploitable vulnerabilities", and point 2 opens "On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable". Known: a flaw nobody knew of at release is not what this point describes (argument, from the word itself). Exploitable: one with "the potential to be effectively used by an adversary under practical operational conditions" (Article 3(41); our glossary row exploitable-vulnerability).

The Commission's guidance reads it the same way. It is a draft of 27 July 2026, not binding, and had not been formally adopted when we checked on 11 October 2026. Point 235: "the mere fact that a vulnerability is reported or found does not, in itself, mean that it is exploitable in practice or applicable to the specific product with digital elements concerned". Point 237 calls the duty "a risk-based obligation": the maker decides, from the risk assessment, whether the product can be released or the vulnerability must be fixed first.

So this point can be failed, and it sits in the top tier. Our reading (argument): the failure is releasing a product with a vulnerability you knew of, that can be used against it, and that your risk assessment does not answer.

After release. Annex I, Part II is a list of handling duties for the support period (Article 13(8)): identify and document, address and remediate without delay, disclose what was fixed. Such a list presumes that vulnerabilities will be found (argument). If one is actively exploited, Article 14 adds a report on a clock; see "Article 14 step by step".

A vulnerability found, triaged, fixed and disclosed is the Regulation working. For which matches are real for your build, see "Only what you built".

What does get a maker into trouble (argument)

Our reading of where the duties bite; it does not say what any authority will do.

• No vulnerability handling process (Annex I, Part II; Article 13(8)).
• No technical documentation (Article 13(12)).
• A declaration signed over a file that contradicts it (Article 28(4): by drawing it up, the manufacturer assumes responsibility for the product's compliance).
• A missed Article 14 report.
• Wrong information given to an authority that asked. This one is evidence: Article 64(4) gives it a tier of its own.

One relief (evidence): micro and small enterprises are not fined for missing the 24-hour early warning (Article 64(10)(a)). The relief is from the fine, not from the duty, and covers that one deadline only; see "What the CRA asks of a one-person firm".

What starts when

Article 14 reporting has applied since 11 September 2026 (Article 71(2)), including for products placed on the market before 11 December 2027 (Article 69(3)). Most of the rest, including the Annex I requirements, the technical documentation and the declaration of conformity, applies from 11 December 2027.

What is not known

• What a country imposes. No Member State's national penalty rules were read for this guide, so it says nothing about any country's amounts or procedure.
• Whether a CRA fine has been issued. We know of none. Two web searches on 13 October 2026 returned no report of one, which does not show that none exists.