Penalties for non-compliance 違反 CRA 的罰則

The structural reading of three numbers 三個數字的結構性讀法

Read at headline level, Article 64 is just three numbers: €15M / 2.5%, €10M / 2%, €5M / 1%. Read structurally, the way the legislator allocated articles to those three tiers tells a more interesting story. The split is not random; it follows a structural-versus-procedural-versus-informational gradient. The legislator placed the structural backbone — Annex I plus Article 13 plus Article 14 — in the highest tier. That placement is a signal about which obligations the legislator considers non-negotiable.

就標題數字讀，第 64 條只是三個數字：€15M / 2.5%、€10M / 2%、€5M / 1%。從結構上讀，立法者把哪些條文放進哪一級，講了一個更有意思的故事。這個劃分不是隨機的；它依循「結構性 vs 程序性 vs 資訊性」的梯度。立法者把結構性骨幹：附件一加第 13 條加第 14 條：放進最高層級。這個放法是一個訊號、告訴你立法者把哪些義務視為不可妥協。

The three tiers, side by side 三個層級並列

What the “higher of” clause does to mid-cap APAC manufacturers 「取高」條款對中型 APAC 製造商的實際影響

For an APAC manufacturer with substantial worldwide revenue, the percentage figure is the binding constraint, not the headline euro cap. A manufacturer with €500M in worldwide annual turnover faces a Tier 1 maximum of €12.5M from the percentage calculation — below the €15M nominal cap, but still a single penalty event that exceeds most companies’ annual contingency budget. At €1B turnover, the percentage gives €25M and the percentage figure overtakes the nominal cap. The structure is deliberately designed to scale with the size of the violator: small companies are protected from existential nominal penalties by the cap; large companies are prevented from treating the cap as a rounding error by the percentage. Mid-cap manufacturers — the bracket most APAC industrial OEMs sit in — feel the percentage figure most acutely.

對營收規模大的 APAC 製造商來說，比例數字才是綁住的上限，不是標題歐元金額。一家全球年營業額 €500M 的製造商、Tier 1 比例算出來的上限是 €12.5M，低於 €15M 名目上限，但仍然是一次處罰超過多數公司年度應急預算。營業額到 €1B，比例算出 €25M、比例數字超過名目上限。這個結構是刻意設計成會隨違反者規模調整：小公司被名目上限保護不至於存亡攸關；大公司被比例條款防止把名目上限當成捨入誤差。中型製造商，多數 APAC 工業 OEM 所在的級別，對比例數字感受最深。

Why the legislator placed those three at the top 立法者為什麼把那三個放在最高層級

Annex I, Article 13, and Article 14 are placed together in the highest tier. Annex I is the set of essential cybersecurity requirements that the product itself must meet. Article 13 is the operational obligation on manufacturers to actually deliver those requirements — the design-time obligations, the supply-chain due diligence, the post-market vulnerability handling, the technical documentation, the support period commitments. Article 14 is the post-market reporting cycle: actively exploited vulnerabilities and severe incidents to ENISA and CSIRTs on the 24h / 72h cadence, with final reports at 14 days for vulnerabilities or one month for severe incidents. The three articles cover what the product must be, what the manufacturer must do to deliver and maintain it, and what the manufacturer must report when something goes wrong. That the legislator chose to apply the same maximum penalty bracket across all three is the formal signal that, in the legislator’s view, none of the three can stand without the others.

附件一、第 13 條、第 14 條一起放在最高層級。附件一是產品本身必須符合的基本網路安全要求集合。第 13 條是製造商實際交付這些要求的操作義務，設計階段義務、供應鏈盡職調查、上市後弱點處理、技術文件、support period 承諾。第 14 條是上市後通報循環：actively exploited vulnerabilities 跟嚴重事件向 ENISA 跟 CSIRT 通報的 24h / 72h 節奏，final report 弱點 14 天、嚴重事件 1 個月。這三條涵蓋了「產品必須是什麼」、「製造商必須做什麼來交付跟維護它」、「出事時製造商必須通報什麼」。立法者選擇對這三者套用相同的最高罰則層級，是個正式訊號，在立法者看來，這三者互相支撐、缺一不可。

A frequently-overlooked nuance: the cap is a ceiling, not a floor 常被忽略的一點：罰則是上限不是下限

Article 64 sets maxima. Actual fines are determined by Member State authorities under the discretion in Art 64(5), which lists the factors: nature, gravity, and duration of the infringement; whether the same operator has been previously fined; the operator’s size, with explicit attention to micro-, small-, and medium-sized enterprises and start-ups. A first-time, well-remediated, fully-cooperated breach by a mid-cap manufacturer can attract a fine well below the nominal ceiling. A repeat, prolonged, or wilfully concealed breach can run to the cap. The point is that Article 64 sets the bracket; the actual number sits inside the bracket and is shaped by how the operator behaves before and during the enforcement process. What Article 64 does not cover — and what often costs more than the fine itself — is the reputational and commercial consequence of being a named subject of a Member State market surveillance enforcement decision. That cost has no statutory ceiling.

第 64 條規定的是上限。實際罰金由會員國機關依 Art 64(5) 所列因素裁量：違反的性質、嚴重性、持續時間；同一經營者過去是否已被處罰；經營者的規模、特別關照微型、中小企業跟新創。中型製造商若是首次違反、積極補救、全程配合，實際罰金可能遠低於名目上限。重複、持續、或刻意隱匿的違反，可能跑到上限。重點是第 64 條設定區間；實際數字落在區間內、由經營者在執法程序前跟程序中的行為塑造。第 64 條沒有涵蓋，而且常常比罰金本身更貴，的是「被列名為會員國市場監督執法決定對象」的商譽跟商業後果。那個成本沒有法定上限。