The ceiling, and what it actually covers
Article 64(2) of Regulation (EU) 2024/2847 sets administrative fines of up to EUR 15,000,000, or for an undertaking, 2.5% of its total worldwide annual turnover for the preceding financial year, whichever is higher. That ceiling applies to breaches of the Annex I essential cybersecurity requirements and to breaches of the manufacturer obligations in Articles 13 and 14 — the same Articles that set out your reporting duties. There is no softer, separate fine schedule just for reporting; a missed or mishandled Article 14 notification is assessed under this top tier.
The microenterprise and small-enterprise carve-out — read the scope carefully
Article 64(10) exempts microenterprises and small enterprises from fines for missing the deadlines in Article 14(2)(a) and 14(4)(a). Those are the early-warning sub-deadlines — the 24-hour clock for an actively exploited vulnerability and its equivalent for a severe incident. The exemption does not extend to the 72-hour notification or the final report, and it does not remove your duty to report at all three stages. If your company qualifies as micro or small, that narrows — it doesn't eliminate — your exposure.
Open-source software stewards
A broader carve-out in the same paragraph exempts open-source software stewards from fines under Article 64 entirely, for any infringement of the Regulation — not just a missed early warning. That is separate from when their reporting duties start: steward reporting under Article 24(3) applies from 11 December 2027, not from the manufacturer Article 14 date — see CRA Article 14 for open-source software stewards.
Giving incomplete information is a separate exposure
Article 64(4) sets a lower ceiling — up to EUR 5,000,000 or 1% of worldwide annual turnover — for supplying incorrect, incomplete or misleading information to a notified body or market surveillance authority when they ask for it. That's a different scenario from simply being late: it's about what you say once an authority is already asking. Keeping your case file internally consistent — the same product, versions, impact and mitigation across the early warning, 72-hour notification and final report — reduces this exposure independently of timing.
Fines aren't the only lever
Beyond administrative fines, market surveillance authorities hold separate powers under the CRA to require corrective action, restrict or prohibit making a product available, or order its withdrawal or recall — powers tied to non-compliance with the Regulation generally, not specifically to a late report. A pattern of missed or thin Article 14 filings is exactly the kind of evidence that invites that scrutiny.
Who sets the actual number
The EUR 15,000,000 / 2.5% figure is a ceiling set by the Regulation, not a fixed EU-wide fine. Article 64(1) requires each Member State to lay down its own penalty rules — effective, proportionate and dissuasive — and to notify them to the Commission. What a real case costs depends on the national rules of the Member State enforcing it, and on the facts: how late, how material, how it was handled.
If you think you're already behind
The fine structure above is about exposure if you don't report, or report badly — it isn't a reason to stay quiet. Work out which clock applies and how overdue it is with the deadline calculator, then open a case in the free CRA Reporting Desk to timestamp your awareness date, keep the facts consistent across whichever reports are still outstanding, and hold the record of what happened and when.
Questions people ask
- Is there a specific fine for missing the 72-hour notification?
- No separate line item. A late or missing Article 14 notification is a breach of the Article 14 obligations themselves, which Article 64(2) places in the top penalty tier: up to EUR 15,000,000 or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher. That is the same ceiling as breaching the Annex I essential cybersecurity requirements.
- Are small companies exempt from these fines?
- Only for one specific thing. Article 64(10) exempts microenterprises and small enterprises from fines for missing the early-warning deadlines in Article 14(2)(a) and 14(4)(a) — the 24-hour clocks. It does not exempt them from the 72-hour notification or final-report deadlines, and it does not remove the underlying duty to report.
- What about open-source software stewards?
- Article 64(10) exempts open-source software stewards from fines under this article entirely — a broader carve-out than the one for small enterprises, which is limited to the early-warning clock.
- Is giving incomplete information worse than being late?
- They sit in different tiers. Supplying incorrect, incomplete or misleading information to a notified body or market surveillance authority in response to a request is penalised separately under Article 64(4), capped at EUR 5,000,000 or 1% of turnover — lower than the ceiling for the underlying Article 14 breach itself, but a distinct exposure on top of it.
- Who actually sets and enforces the fine amount?
- The Regulation sets ceilings; Article 64(1) requires each Member State to lay down its own penalty rules — effective, proportionate and dissuasive — and notify the Commission. The amount that applies to a real case depends on national rules, not a single EU-wide schedule.
- I think we're already late on a notification. What should I do first?
- Record the awareness date you're working from, work out the deadline that actually applies, and file as soon as you can — lateness doesn't erase the duty to report. Use the deadline calculator to see exactly how overdue each clock is, then open a case in the free desk to keep the record of what happened and when.