What are the penalties for non-compliance with the Cyber Resilience Act?

Under the EU Cyber Resilience Act (CRA), serious violations can result in fines of up to €15 million or 2.5% of the company’s total worldwide annual turnover, whichever is higher. In addition to financial penalties, non-compliance may lead to market access restrictions, mandatory corrective actions, product recalls, and reputational damage.