What the exemption says
Breaking Article 14 can mean administrative fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64(2)). Article 64(10) makes one exception: manufacturers that are micro or small enterprises aren’t fined for missing the 24-hour deadline for the early warning, whether for an actively exploited vulnerability or a severe incident.
Recital 120 says so plainly, and adds that member states shouldn’t impose other kinds of financial penalty for it either.
What it doesn’t cover
- The early warning itself. The duty to send it stands. The exemption is about the fine for being late, not a licence to skip it.
- The 72-hour notification and the final report. Missing those can be fined as usual.
- Medium-sized and larger companies. Only micro and small enterprises are covered.
- The rest of the CRA. From 11 December 2027, gaps in the security requirements and vulnerability handling can be fined too, whatever your size. Size then counts when the fine is set (Article 64(5)).
A detail in the wording
Article 64(10) is worded as an exception to paragraphs 3 to 9, while the fines for breaking Article 14 are set in paragraph 2. Read literally, the cross-reference misses the paragraph that matters. Recital 120 states the intent without that ambiguity. If it ever matters in a real case, it’s a point for a lawyer.
Are you a small enterprise?
The CRA uses the EU definition (Recommendation 2003/361/EC):
| Staff (annual work units) | Annual turnover or balance sheet total | |
|---|---|---|
| Microenterprise | Fewer than 10 | At most EUR 2 million |
| Small enterprise | Fewer than 50 | At most EUR 10 million |
| Medium-sized enterprise | Fewer than 250 | Turnover at most EUR 50 million, or balance sheet total at most EUR 43 million |
If your company is part of a group, the group’s figures count. A subsidiary of a large group isn’t a small enterprise, however small it is on its own. And your category only changes once you’ve been over or under a ceiling for two accounting years in a row.
Norwegian manufacturers
Fines are set by each member state’s rules and imposed by its market surveillance authority (Article 64(1)). Until the CRA is part of the EEA Agreement, Norwegian authorities can’t impose penalties under it (does the CRA apply before the EEA?). For the products you sell in the EU, enforcement is a matter for the authorities in the member states concerned.
Why you should still meet the 24 hours
- The 72-hour notification and the final report have their own deadlines, and those aren’t exempt.
- The CSIRTs and ENISA need the warning to alert others in time. That’s why the deadline is so short.
- Customers and partners ask. A missed deadline is hard to explain in a security review, fine or no fine.
- Help is there: the CSIRTs designated as coordinators must offer helpdesk support on reporting, in particular to micro, small and medium-sized companies (Article 17(6)).
When the deadline starts is in the article on actively exploited vulnerabilities, and what each report must contain is in the CRA playbook.
