Exposure and risk register
The scale is set out in Penalties. This page turns it into a number, and then into a register.
The three exposures
1. Administrative exposure
The higher of EUR 15,000,000 and 2.5 % of total worldwide annual turnover for the preceding financial year, for breaches of the essential requirements and of the Article 13 and 14 obligations.
The calculation to put to the committee:
Administrative exposure = max(EUR 15,000,000 ; 0.025 × consolidated worldwide turnover FY-1)That figure is a ceiling, not a forecast. It sizes the effort; it does not predict a fine.
2. Commercial exposure
Often an order of magnitude larger, and faster to materialise.
Commercial exposure = (turnover made in the Union / 12) × duration in months
of a prohibition on making available, or of a withdrawalAdd the cost of a recall where the product is hardware: logistics, replacement, communications.
3. Contractual exposure
Penalties, regulatory compliance clauses, termination rights and indemnities in your customer contracts. This exposure is read in the contracts, not in the Regulation, and it is often the most immediate: a large account may suspend a contract long before an authority acts.
The compliance risk register
Kept by Legal, reviewed at every committee. One row per identified risk:
| Column | Content |
|---|---|
| Risk | Phrased as an event, not as a gap |
| Products affected | With their share of turnover |
| Cause | Technical, organisational or documentary shortfall |
| Likelihood | Four-point scale, with written criteria |
| Impact | The three exposures above |
| Measures in progress | With owner and deadline |
| Residual risk | After measures |
| Decision | Treat, reduce, transfer, accept — with the name of whoever accepts |
The “accept” column is essential: a risk accepted by an identified person is not an ignored risk. It also protects the teams where a budget trade-off was made knowingly.
Typical rows
| Risk | Cause | Measure |
|---|---|---|
| Unable to produce the technical documentation for a version shipped in 2028 during a 2033 inspection | Archiving never tested | Annual retrieval exercise |
| Missing the 24-hour deadline over a weekend | No legal on-call cover | Written delegation + on-call rota |
| A class II product with no notified body engaged | Market capacity saturated | Contract immediately |
| An untenable support period on a product built on an abandoned upstream component | Insufficient diligence at integration | Replacement or take-over plan |
| An AGPL component in an online offering | Licence policy not enforced in CI | CI blocking + audit of the existing estate |
The effect on corporate transactions
The CRA has become a standard item in acquisition due diligence and fundraising. An acquirer will ask for:
- the portfolio classification register;
- the existence and completeness of the technical documentation;
- the reporting register and compliance with deadlines;
- the support period register and the commitments attached;
- licence compliance, with the exception register.
A gap on any of these translates into a liability warranty, a price holdback or a condition precedent. It is a funding argument in its own right, and often the most effective one with a committee.