With the proposed Cyber Resilience Act (CRA-E), the European Commission has set itself the goal of strengthening the security of products with digital elements with horizontal legal requirements in order to better protect the European internal market from growing cyber threats. Concerning this matter, the regulation contains a large number of obligations that apply to all economic operators in a product supply chain, namely manufacturers, importers and distributors.

In order to ensure compliance with these obligations in practice, the regulation also provides for the possibility of penalties that can be imposed on economic operators in the event of non-compliance with the legal requirements.

However, the CRA-E leaves the Member States a great deal of leeway in terms of the legal structure. According to Art. 53 (1) CRA-E, they shall lay down the rules on penalties and take the measures necessary for enforcement. With the wording in Art. 53 (1) CRA-E that the penalties shall be effective, proportionate and dissuasive and with the upper limits for fines specified in Art. 53 (3–5) CRA-E, the regulation provides a framework that must be filled in by national law. A corresponding requirement for fines is already known in Art. 83 (1) GDPR.

The competent market surveillance authority in whose Member State the affected product with digital elements was made available on the market is responsible for issuing penalties and imposing fines. However, this does not necessarily mean that a manufacturer, for example, has to fear high fines in all Member States. According to Art. 53 (6) lit. b) CRA-E, when assessing a fine, it must also be taken into account whether other market surveillance authorities have already imposed fines for a similar infringement. What is interesting here is that reference is made to "similar" infringements – thus the same infringement does not have to have already been sanctioned once.

The upper limits for the amount of fines are set out in Art. 53 (3 - 5) CRA-E. The highest fines can be imposed for non-compliance with the requirements in Annex I or for breaches of the manufacturer's obligations in Art. 10 and 11 CRA-E. Fines of up to €15,000,000 or up to 2.5% of the previous year's total global turnover are possible.

In the event of breaches of the other obligations of the CRA-E, fines of up to €10,000,000 or 2% of the previous year's global turnover are possible in accordance with Art. 53 (4) CRA-E. This will primarily affect importers and distributors, whose obligations are set out in Art. 13 and 14 CRA-E.

In addition, incorrect, incomplete or misleading information to notified bodies and market surveillance authorities may result in fines of up to €5,000,000 or up to 1% of the previous year's global turnover, Art. 53 (5) CRA-E.

The amount of the fine depends on the nature, gravity and duration of the infringement and its consequences in accordance with Art. 53 (6) CRA-E. These criteria are likely to be familiar to the addressees from other EU regulations, such as the GDPR or the Digital Services Act.

Possible changes in the final version of the CRA-E

Based on the Commission's proposal for a regulation, the European Parliament's Committee on Industry, Research and Energy (ITRE) and the Council of the European Union have also published drafts. The legislative process is currently undergoing final coordination.

In principle, the aforementioned provisions on fines in the CRA-E have not changed. In its draft, the ITRE has also included in Art. 53 CRA-E that the financial resources of SMEs are taken into account when calculating a fine. In addition, the Commission shall ensure that those rules and measures are applied uniformly throughout the EU, which is probably intended to prevent the penalties imposed from differing greatly from one another. Furthermore, Art. 53a CRA-E was introduced, according to which the revenue from the penalties shall be allocated to projects raising the level of cybersecurity within the Union.

The Council has not deviated from the Commission draft in Art. 53 CRA-E apart from a few linguistic changes.

Practical recommendations

As the European legislator grants the member states regulatory competence regarding the penalties of the CRA, it remains to be seen whether the German legislator will maintain the framework of the CRA-E or deviate from it. Nevertheless, the provisions of the CRA-E should be taken into account as a general benchmark, as the majority of member states are likely to implement the provisions in full. Consequently, the requirements of the CRA-E and the further legislative process should already be taken into account now in order to avoid the risk of fines in the future.

In our CRA-Update series, we regularly present information on the proposed Cyber Resilience Act and keep you informed about changes in the ongoing legislative process. In each of our articles, we give you a brief overview of a specific topic, presenting the most important aspects and practical implications.