Skip to main content

CRA Liability and Penalty Exposure Checker

Article 64 of Regulation (EU) 2024/2847 (Cyber Resilience Act) defines administrative penalties for non-compliance. Maximum fines reach up to €15,000,000 or 2.5% of worldwide annual turnover.

The CRA Liability Checker at https://cvdportal.com/tools/cra-liability-check provides an interactive, client-side evaluation tool. It calculates your maximum statutory penalty exposure based on your operator role, product class, and completed conformity artifacts.

How liability works under the CRA​

The CRA does not establish strict liability for the presence of a security flaw. Administrative fines penalise failures of cybersecurity diligence, missing technical files, and omitted statutory notifications.

Each item is a duty that the CRA sets. An open item carries a fine tier only when its duty is in force (Article 71(2)). Article 14 applies since 11 September 2026. The other duties apply from 11 December 2027. Before that date, the tool shows them as "From 11 December 2027" with the fine tier that will apply, and leaves them out of the active fine tier and the exposure level.

  1. Product class and conformity route (Article 32). Article 32 sets the conformity route for each product class. A product that needs a notified body or a certification scheme cannot use Module A self-assessment alone. Tier 2 under Article 64(3), up to €10,000,000 or 2%. Applies from 11 December 2027.
  2. Annex I Assessment (Annex I Part I & Part II). Documents fulfillment of security properties and vulnerability handling duties. Tier 1 under Article 64(2), up to €15,000,000 or 2.5%. Applies from 11 December 2027.
  3. Technical Documentation (Article 31, Annex VII). Compiles the compliance dossier before placing products on the market. Tier 2 under Article 64(3). Applies from 11 December 2027.
  4. EU Declaration of Conformity (Article 28, Annex V). Attests compliance to substantiate CE marking. Tier 2 under Article 64(3). Applies from 11 December 2027.
  5. Article 14 reporting readiness (Article 14). The 24-hour early warning and the 72-hour notification to ENISA and the coordinating CSIRT. A missed notification falls under Tier 1 of Article 64(2). The CRA asks for the notification itself, and a written procedure is the usual way to meet the deadline. Applies since 11 September 2026.

The exposure level reads "Pending" when every open item waits for its date.

Exposure-reduction map​

The tool maps each open conformity gap to a concrete product action:

  • Classification gaps link to the product classifier (/classify).
  • Annex I and DoC gaps link to the CRA self-assessment workspace (/cra-self-assessment).
  • Technical file gaps link to the CRA maturity assessment (/cra-maturity-assessment).
  • Article 14 reporting gaps link to the coordinated vulnerability disclosure intake onboarding (/register).

Market surveillance authorities scale fines under Article 64 proportionality criteria, considering company size, mitigation actions, and compliance cooperation.

The tool provides technical compliance estimation. It does not provide legal advice.