CRA

CRA Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex CRA scenarios: penalty tiers, the actively-exploited-vulnerability/incident reporting chain, and interaction with the EU AI Act.

10 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 10

Under Article 64(2), what is the maximum fine for non-compliance with the essential cybersecurity requirements in Annex I, or with Articles 13 and 14?

Up to EUR 15,000,000 or 2.5% of total worldwide annual turnover, whichever is higherA flat EUR 500 fine regardless of severityUp to EUR 500,000 with no turnover-based alternativeThere is no monetary penalty, only a warning letter

Question 2 of 10

Under Article 64(3), what is the maximum fine for non-compliance with the broader list of other CRA obligations not covered by paragraph 2?

Up to EUR 10,000,000 or 2% of total worldwide annual turnover, whichever is higherUp to EUR 50,000,000 with no percentage alternativeThe same tier as paragraph 2, with no distinctionNo fine, only a public reprimand

Question 3 of 10

Under Article 64(4), what is the maximum fine for supplying incorrect, incomplete, or misleading information to a notified body or market surveillance authority?

Up to EUR 5,000,000 or 1% of total worldwide annual turnover, whichever is higherUp to EUR 15,000,000 in all casesThere is no penalty for misleading information, only for the underlying non-conformityA mandatory prison sentence with no fine

Question 4 of 10

Under Article 3(42), what makes a vulnerability an 'actively exploited vulnerability' rather than simply a known vulnerability?

Any vulnerability that is merely theoretically exploitableThere is reliable evidence that a malicious actor has exploited it in a system without permission of the system ownerAny vulnerability disclosed in a public CVE databaseOnly vulnerabilities discovered by the manufacturer’s own internal team

Question 5 of 10

Under Article 3(30), what is a 'substantial modification', and why does it matter?

Any cosmetic change to product packaging, which has no compliance consequenceA change after placing on the market that affects compliance with Annex I Part I essential requirements, or changes the intended purpose the product was assessed against — potentially triggering a fresh conformity assessmentA change that only affects the product’s price, with no legal consequenceAny change made by the end user rather than the manufacturer, which is never in scope

Question 6 of 10

A manufacturer's SBOM (Article 13/Annex I Part II point 1) and its technical documentation (Article 31/Annex VII) retention obligation (Article 13(13)) both need to be current. How do their required durations compare?

SBOM must be maintained only once at launch with no updates, while technical documentation is destroyed after 1 yearThe SBOM is part of the ongoing vulnerability-handling duty for the support period (min. 5 years), while technical documentation and the EU declaration of conformity must be kept for at least 10 years after market placement or the support period, whichever is longer — the documentation retention duty can outlast the active support periodBoth must be destroyed immediately once the product is withdrawn from saleThere is no retention requirement for either document

Question 7 of 10

A company sells a connected consumer device with an embedded high-risk AI system under the EU AI Act. How do the CRA and the AI Act's Article 15 cybersecurity requirement interact?

Only the AI Act applies; the CRA is automatically disapplied whenever AI is involvedThey are mutually exclusive and a company must choose only one to comply withOnly the CRA applies; the AI Act’s cybersecurity provision is repealed by the CRABoth can apply simultaneously: Article 15 of the AI Act is one requirement among several for the high-risk AI system, while the CRA is a separate, more detailed product-cybersecurity regime (SBOM, coordinated disclosure, its own incident-reporting timeline) covering the connected product generally, AI or not

Question 8 of 10

Under Article 13, which of the following are real, distinct manufacturer obligations (as opposed to being combined into a single duty)?

Select all that apply.

Conducting and documenting a cybersecurity risk assessmentExercising due diligence when integrating third-party/open-source componentsMaintaining a vulnerability-handling process including coordinated disclosure, referred to in Annex I Part II point 5Setting the product’s retail price, which the CRA does not regulate

Question 9 of 10

Where does the requirement for a manufacturer's coordinated vulnerability disclosure policy come from?

It is not required anywhere in the CRAAnnex I, Part II, point 5, referenced by Article 13(8) as part of the vulnerability-handling requirementsIt is only a voluntary industry best practice with no legal basis in the CRAIt is defined solely in Article 64’s penalty provisions

Question 10 of 10

A manufacturer both designs the hardware for a connected device and separately develops its firmware. Under Article 3's definitions, how does the CRA treat this?

Hardware and firmware are regulated under two entirely separate regulations with no single manufacturer obligationOnly the firmware is in scope; embedded hardware is never a "product with digital elements"A "product with digital elements" explicitly covers both software and hardware products (and remote data processing solutions), so the same manufacturer obligations under Article 13 apply to the combined productOnly the party that sells the final assembled device to consumers has any obligations, never the component designer

0 of 10 answered