"€15 million or 2.5% of turnover" is the line that gets the CRA onto a board agenda. It's worth understanding precisely, because it's a ceiling rather than a flat fine, it's tiered by what you got wrong, and the monetary penalty is only part of what an authority can do to you.
Three tiers of fine
The CRA scales the maximum fine to the seriousness of the breach:
| Breach | Maximum fine |
|---|---|
| Essential requirements (Annex I) and core manufacturer obligations | €15M or 2.5% of worldwide turnover |
| Other obligations under the regulation | €10M or 2% of worldwide turnover |
| Supplying incorrect, incomplete or misleading information to authorities or notified bodies | €5M or 1% of worldwide turnover |
In every tier it's the higher of the fixed sum or the turnover percentage — so the exposure scales with the size of the business, and for a large manufacturer 2.5% of global turnover can dwarf €15 million.
Who enforces it
The CRA is enforced by national market-surveillance authorities — the same machinery that polices other CE-marked products. They can open investigations, demand information, require corrective measures, and impose the administrative fines above. Enforcement is national, but the obligations are EU-wide, so placing a product across the single market means answering to whichever authority takes an interest.
The powers beyond fines
For many manufacturers the fine isn't the sharpest risk. Market-surveillance authorities can also restrict how a product is made available, order its withdrawal, or require a recall. A product pulled from the EU market — or a customer-facing recall — can cost far more than a fine, in revenue and reputation both. The financial penalty is the headline; the market-access powers are what can stop a business.
The number in context
The penalty isn't the cost of the CRA. It's the cost of not being able to show you met it.
Fines follow breaches, and breaches, in practice, are failures you can't defend — an unreported actively-exploited vulnerability, a not_affected you decided on without basis, a technical file that doesn't support its Declaration of Conformity. The exposure is real, but it's answered by the same thing the rest of the CRA rewards: documented, defensible evidence. That's the throughline of the manufacturer's guide, and it starts with the first enforceable obligation — reporting, live from September 2026.
Frequently asked
What are the maximum fines under the CRA?
The top tier is €15 million or 2.5% of total worldwide annual turnover, whichever is higher, for breaches of the essential requirements or the core manufacturer obligations. A second tier reaches €10 million or 2%, and supplying incorrect, incomplete or misleading information to authorities or notified bodies is capped lower again.
Who enforces CRA penalties?
National market-surveillance authorities in each member state. They can investigate, require corrective action, and impose administrative fines, alongside powers to restrict, withdraw or recall a non-compliant product.
Is 2.5% of turnover or €15 million applied?
Whichever is higher. For a large company, 2.5% of worldwide turnover can far exceed €15 million; for a smaller one, the €15 million figure is the effective ceiling. Either way it is set against, not instead of, the cost of compliance.