> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/cra/chapter-vii-confidentiality-and-penalties-art.-63-65/64.md). # Art. 64 — Penalties CRA Article 64 — Penalties. Regulation (EU) 2024/2847, Chapter VII — Confidentiality and penalties. 1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, without delay, notify the Commission of those rules and measures and shall notify it, without delay, of any subsequent amendment affecting them. 2. Non-compliance with the essential [cybersecurity](https://headlesslaw.com/definitions/cra/cybersecurity/) requirements set out in Annex I and the obligations set out in [Articles 13](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/13.md) and [14](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) shall be subject to administrative fines of up to EUR 15000000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher. 3. Non-compliance with the obligations set out in [Articles 18](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/18.md) to 23, [Article 28](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/28.md), [Article 30(1)](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/30.md) to (4), [Article 31(1)](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/31.md) to (4), [Article 32(1)](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/32.md), (2) and (3), [Article 33(5)](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/33.md), and [Articles 39](/cra/chapter-iv-notification-of-conformity-assessment-bodies-art.-35-51/39.md), [41](/cra/chapter-iv-notification-of-conformity-assessment-bodies-art.-35-51/41.md), [47](/cra/chapter-iv-notification-of-conformity-assessment-bodies-art.-35-51/47.md), [49](/cra/chapter-iv-notification-of-conformity-assessment-bodies-art.-35-51/49.md) and [53](/cra/chapter-v-market-surveillance-and-enforcement-art.-52-60/53.md) shall be subject to administrative fines of up to EUR 10000000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. 4. The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request shall be subject to administrative fines of up to EUR 5000000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. 5. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following: 1. the nature, gravity and duration of the infringement and of its consequences; 2. whether administrative fines have been already applied by the same or other market surveillance authorities to the same [economic operator](https://headlesslaw.com/definitions/cra/economic-operator/) for a similar infringement; 3. the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the infringement. 6. Market surveillance authorities that apply administrative fines shall communicate that application to the market surveillance authorities of other Member States through the information and communication system referred to in Article 34 of Regulation (EU) 2019/1020. 7. Each Member State shall lay down rules on whether and to what extent administrative fines may be imposed on public authorities and public bodies established in that Member State. 8. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or other bodies according to the competences established at national level in those Member States. The application of such rules in those Member States shall have an equivalent effect. 9. Administrative fines may be imposed, depending on the circumstances of each individual case, in addition to any other corrective or restrictive measures applied by the market surveillance authorities for the same infringement. 10. By way of derogation from paragraphs 2 to 9, the administrative fines referred to in those paragraphs shall not apply to the following: 1. manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in [Article 14(2)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md), point (a), or [Article 14(4)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md), point (a); 2. any infringement of this Regulation by open-source [software](https://headlesslaw.com/definitions/cra/software/) stewards. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/cra/chapter-vii-confidentiality-and-penalties-art.-63-65/64.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.