CFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting

Which dates affect EU revenue and should go into financial planning first?

The AI Act deadlines are as amended by Regulation (EU) 2026/1744.

What are the maximum penalties, and how should the annual report's risk items handle them?

• EU CRA Article 64: up to EUR 15 million or 2.5% of worldwide annual turnover for breaching the essential requirements
• EU AI Act Article 99: up to EUR 35 million or 7% for prohibited practices; up to EUR 15 million or 3% for other obligations

Whichever is higher in each case. Beyond penalties, customer requirements and market access usually bite first. Article 20, item 6 of the annual report regulations requires an analysis of how major domestic and foreign policy and legal changes affect finances and business, and EU law falls among these risk items. The annual report regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

Do CRA or AI Act penalties, or the risk of products being unable to enter the market, require a provision in the financial statements?

Under IAS 37, a provision requires three conditions at the same time:

1. a present obligation (legal or constructive) as a result of a past event
2. it is probable that an outflow of resources will be required to settle it
3. a reliable estimate can be made of the amount

If these are not met, no provision is recognised. A contingent liability is not recognised in the statement of financial position, but is disclosed in the notes unless the possibility of an outflow is remote.

The first condition requires the obligation to arise from a past event. Breaches that have not occurred and market access risk belong first in the annual report's risk analysis; only a breach that has occurred or proceedings by an authority lead into the provision or contingent liability assessment. Recognition, disclosure and the amount are for the auditor to judge case by case.

How should the budget be split, and which part is most often underestimated?

The CRA budget has four parts:

1. Internal staff: time from product security, R&D and legal
2. Consulting: classification and role determination, risk assessment, technical documentation, vulnerability handling and reporting processes
3. External assessment: notified body assessment (only where third-party assessment is required) and testing
4. Ongoing costs: vulnerability handling and reporting during the support period, every year

The most underestimated is the ongoing cost; the support period is in principle at least five years. Complexity depends on the number of combinations of product class and supply chain role, not the number of products. This page lists no fees.

Own brand, ODM, OEM: who is the legal manufacturer, and how are contract responsibilities split?

If you also sell the same product in the EU under your own brand, you are the manufacturer for that part.

If a product falls under both the CRA and the AI Act, what can be shared? Can a certificate replace compliance?

CRA Article 12: a product meeting the CRA Annex I essential requirements, with the CRA declaration of conformity stating that the level of cybersecurity protection required by AI Act Article 15 is achieved, is presumed to meet the cybersecurity requirements of AI Act Article 15; accuracy and robustness are not covered.

• Shared: the cybersecurity parts of one risk assessment, technical documentation and declaration of conformity
• Budget separately: AI risk classification, data governance, human oversight and accuracy validation

Neither law has a standalone certificate; ISO 27001 is not a CRA harmonised standard, and ISO 42001 certification gives no presumption of conformity with the AI Act. As listed on the service page, high-risk AI Act compliance usually takes 6–9 months, or 9–12 months with ISO 42001 certification.

How does Winners Consulting help a CFO with the EU CRA and the EU AI Act?

• VP- and director-level consultants lead the work end to end, never outsourced; Winners is a consultant and does not perform assessments
• We first determine whether the product is in scope, its class and its conformity assessment route, then build the vulnerability handling process, SBOM and Annex VII technical documentation, and prepare the Article 14 reporting process
• Work can be commissioned in stages: classification and gap diagnosis, SBOM and vulnerability evidence, and integration of technical documentation and reporting; actual fixes, test laboratories and third-party assessment fees are excluded
• ISO 42001 and the EU AI Act are integrated so they share one set of documents and evidence

As of 2026-10, Winners has 6 EU Cyber Resilience Act (CRA) compliance engagements (names withheld under NDA). Read more: EU CRA compliance, EU AI Act, CRA budget, AI governance budget, CFO role page. Request a free mechanism diagnosis