How high are the fines for CRA non-compliance?

Up to EUR 15 million or 2.5% of global annual turnover (whichever is higher) per Art. 64 CRA. Additionally, non-compliant products face a sales ban in the EU from December 2027.

When does CRA enforcement begin?

ENISA reporting obligations begin in September 2026. Full enforcement of all CRA requirements including potential market bans begins in December 2027.

How is the ROI of CRA compliance calculated?

The ROI considers avoided fines (up to 2.5% of revenue), avoided market access loss, reduced brand damage, and the cost of the compliance solution compared to manual processes or external consultants.

Business Case

What Does CRA Non-Compliance Cost?

Calculate the financial impact for your company — and how Kunnus reduces your risk.

2.5%

of global annual revenue as fines

100%

loss of EU market access

Sep 2026

ENISA reporting obligation starts

Dec 2027

full enforcement or market ban

Source: CRA Art. 64 — Penalties and sanctions, Regulation (EU) 2024/2847

Select Industry

Your Company Data

Global Annual Revenue

€200M

CRA-Relevant Product Share

35%

EU Revenue Share

70%

Number of Products with Digital Elements?A product with digital elements is any product with a direct or indirect logical or physical data connection to a device or network — hardware with embedded software, pure software products, or cloud services required for a product's core function.More in the Knowledge Base

50pcs

Estimated Brand Impact

Substantial Changes / Year?A substantial change occurs when the security architecture, intended purpose, or risk class of a product is significantly modified. In this case, the conformity assessment must be repeated.More in the Knowledge Base

10/yr

Probability of Compliance Gaps?Based on IEC 62443 audit findings and GDPR enforcement experience: Leading auditors report that approx. 30% of affected companies show significant compliance gaps. Adjust to your own assessment.

15%

Your CRA Risk Analysis

Total Exposure from Non-Compliance

€30.9M

from non-compliance

Risk-Weighted Derivation

Without Kunnus (risk-weighted)€4.6M

With Kunnus (risk-weighted)€248K

→

Risk Reduction€4.4M

Based on IEC 62443 audit findings and GDPR enforcement experience: Leading auditors report that approx. 30% of affected companies show significant compliance gaps.

Your Annual Savings with Kunnus

€4.7M

per year

Risk Reduction: €4.4MCost Savings: €300K

Setup (Year 1)

Without Kunnus€404K

With Kunnus~€86K

Savings€319K

Ongoing / Year

Without Kunnus€381K

With Kunnus~€81K

Savings / Year€300K

Risk

high

vs.

minimal

FTE

3.2–5.2 FTE

vs.

~0.5 FTE

Time

12–18 months

vs.

3–6 months

Cost

€381K

vs.

~€81K

Total Exposure from Non-Compliance: €30.9M

Brand & Reputation Damage (2%)€980K

Regulatory Fine€15.0M

Art. 64 CRA: up to €15M or 2.5% of global annual turnover — whichever is higher

EU Revenue Loss (Market Ban)€9.8M

Non-compliant products may not be sold in the EU from Dec 2027

Supply Chain & Customer Loss€3.9M

B2B customers already making CRA compliance a procurement requirement — delisting from approved vendor lists

Recall & Remediation Cost€1.3M

Art. 58-59 CRA: market surveillance authorities can order product recall and remediation

Download Analysis as PDF

Enter your details and download your individual CRA risk analysis directly as PDF.

Model based on IEC 62443 audit findings, GDPR enforcement experience, and CRA Art. 64 (penalties), Art. 58-59 (market surveillance). The gap rate is based on findings from leading auditors. Actual values vary depending on your company's situation. Contact us for an individual analysis.