EU CRA for the CEO: European orders, penalties and ownership. What to decide now

Could the CRA keep our products out of Europe? What should the CEO take stock of first?

Yes, if a product is in scope and you are not ready. From 11 December 2027, products that do not meet the essential cybersecurity requirements and have no conformity assessment and CE marking cannot be placed on the EU market.

Ask the product lines two things:

• Scope: products with digital elements (software, hardware with firmware, and remote data processing essential to the product's functions) are in scope; ordinary SaaS cloud services are outside the CRA and fall under NIS2 instead; components of type-approved vehicles are excluded (Article 2(2)(c)).
• Class × role: which class each product family falls into (default, important class I, class II or critical), and whether each product line is placed on the market as manufacturer, importer or distributor.

The workload is driven by the number of combinations, not the number of products.

How heavy are CRA penalties? Does the company pay, or the CEO personally?

• Maximum fine: for breaching the Annex I essential requirements and Articles 13 and 14, up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64).
• Who: the obligations sit with the manufacturer as a legal entity (Article 13). The rules are enforced by each Member State's market surveillance authorities; where a product does not comply, they can require the operator to bring it into compliance, withdraw it from the market or recall it within a reasonable period (Article 54(1)).
• Personal liability: whether the CEO carries any personal liability depends on national law and internal delegation, and is for legal counsel to assess case by case.

What the CEO can control is that product launch decisions, support period decisions and reporting authority are all documented, showing the company has a system rather than an improvised response.

Which department should own the CRA? Whom should the CEO appoint?

The CRA does not name a department; the obligations sit with the manufacturer as a legal entity. In practice, split it like this:

The IT department runs the company's internal systems; product security should not default to it, because the development process, component lists and launch decisions are not in IT's hands. Two rules when appointing: each task has only one accountable owner, and "accountable" and "independent assurance" must not sit with the same person.

CRA reporting has already started. What should the CEO check now?

Article 14 reporting has applied since 11 September 2026, including for products already on the EU market. After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer reports through ENISA's single reporting platform:

• an early warning within 24 hours
• a notification within 72 hours
• a final report: for vulnerabilities, within 14 days after a corrective measure is available; for incidents, within one month after the notification

The CEO should check three things:

1. Who can decide to report: if the contact point has no authority to decide, the 24 hours cannot be met; delegate in advance.
2. The night and holiday call chain: the clock starts on awareness, not office hours.
3. Customer contracts: reporting timelines in ODM and OEM contracts must line up with the legal deadlines.

We do ODM and OEM work. A European brand customer wants us to support its CRA compliance. What must be settled before we accept the order?

First settle who the legal manufacturer is:

Before accepting the order, the contract should fix the scope of deliverables, the support period and reporting cooperation timelines. The support period is in principle at least 5 years, an ongoing commitment that affects pricing and staffing. If you also sell the same product in the EU under your own brand, for that part you are the manufacturer. Contract terms should be reviewed by legal or outside counsel.

How should the CRA be reported to the board, and how should it be budgeted?

Budget in four blocks: internal staff time, consulting, external assessment (only where a third-party assessment is required) and ongoing costs. Vulnerability handling and reporting during the support period is a recurring yearly cost, not a one-off project; reserve that capacity first.

Board reporting: treat the CRA as a compliance risk within the existing risk management policy and regular reports, rather than a separate track:

• TWSE/TPEx Risk Management Best Practice Principles, Articles 13, 15 and 18: the board approves the risk management policy and oversees it; the risk management unit reports at least once a year; risk categories include compliance risk.
• Regulations Governing Establishment of Internal Control Systems by Public Companies, Article 3: compliance with laws and regulations is one of the internal control objectives.

These regulations and principles apply to public or listed companies; non-public companies are not bound by them but can follow them voluntarily.

How does Winners Consulting help the CEO handle the EU CRA?

VP- and director-level consultants lead the work end to end, never outsourced; Winners Consulting only consults and does not assess or certify.

• Determine first: whether the product is in scope, which class it falls into and which conformity assessment route applies, and the supply chain role of each product line.
• Then build: the vulnerability handling process, SBOM and Annex VII technical documentation required by Annex I, plus the Article 14 reporting process.
• Three work packages: scope and gap diagnosis, SBOM and vulnerability evidence, and technical documentation with the reporting process, so you can see what to buy and what you already have.
• Track record: as of 2026-10, Winners has 6 EU Cyber Resilience Act (CRA) compliance engagements (names withheld under NDA).

Read more: EU CRA compliance, Which department leads the CRA, CRA timeline, CRA budget, Choosing a CRA consultant.

Request a free mechanism diagnosis