Whats is the CRA?
What Is the EU Cyber Resilience Act (CRA)?
The EU Cyber Resilience Act (CRA) is a European regulation that establishes cybersecurity requirements for products with digital elements.
Formally adopted as Regulation (EU) 2024/2847, the CRA introduces mandatory cybersecurity requirements for hardware and software products placed on the EU market.
The regulation takes a lifecycle approach to product security. It covers not only the design and development of products but also vulnerability management, security updates, and the provision of security-related information throughout the product's support period.
Its primary objective is to strengthen the cybersecurity of digital products, reduce risks associated with vulnerabilities, and enable consumers and businesses to make more informed decisions about product security.
Importantly, the CRA is not limited to companies established in the European Union. Manufacturers based outside the EU may also need to comply when making covered products available on the EU market.
Security Throughout the Product Lifecycle
The CRA represents a shift from treating cybersecurity as a one-time product requirement to managing security throughout a product's lifecycle.
Two fundamental principles underpin this approach: security by design, which integrates cybersecurity into product development from the outset, and security by default, which ensures that products are delivered with appropriately secure configurations.
Products Covered by the CRA
The CRA generally applies to products with digital elements made available on the EU market in the course of a commercial activity. These include hardware and software products whose intended or reasonably foreseeable use involves a direct or indirect data connection to a device or network.
The scope is not limited to finished products. Software and hardware components made available separately on the market may also fall within the regulation.
Hardware Products
Connected devices such as IoT products, networking equipment, smart devices, and industrial control systems may fall within the scope of the CRA.
Software Products
The CRA also covers a wide range of software, including business applications, consumer software, and operating systems. Applicability depends on the product's intended purpose and how it is supplied to the market.
Digital Components
Hardware and software components intended for integration into other products may also be subject to the CRA when supplied separately on the EU market.
Economic Operators
The CRA establishes obligations for manufacturers, importers, and distributors. The specific responsibilities depend on each company's role in the supply chain.
Determining Whether the CRA Applies
The CRA's applicability depends on several factors, including product functionality, intended use, distribution model, and the relationship with other EU legislation.
Certain product categories, including some medical devices, are excluded from its scope where specific EU legislation already applies. Companies should therefore assess applicability on a product-by-product basis.
Key CRA Requirements
The CRA introduces a comprehensive set of cybersecurity obligations, primarily for manufacturers, covering product development, conformity assessment, and ongoing security management after products enter the market.
Effective compliance requires more than implementing individual security controls. Companies need processes for assessing risks, maintaining technical documentation, managing vulnerabilities, and demonstrating conformity with applicable requirements.
Secure Product Design and Development
- Conduct product cybersecurity risk assessments
- Integrate cybersecurity into product design and development
- Provide secure default configurations
- Address known exploitable vulnerabilities
- Prepare and maintain the required technical documentation
Vulnerability Management and Security Updates
- Identify, assess, and remediate vulnerabilities
- Create and maintain a Software Bill of Materials (SBOM)
- Provide security updates when required
- Establish a coordinated vulnerability disclosure process
- Define the product support period and communicate it to users
The CRA generally requires a support period of at least five years, subject to specific provisions and exceptions, including considerations relating to the product's expected period of use.
Conformity Assessment and CE Marking
- Carry out the applicable conformity assessment procedure
- Involve a notified body where required
- Draw up an EU Declaration of Conformity
- Affix the CE marking in accordance with the applicable requirements
- Maintain documentation for market surveillance purposes
Vulnerability and Incident Reporting
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products, in accordance with the CRA's reporting requirements.
- Early warning within 24 hours of becoming aware
- Notification within 72 hours of becoming aware
- Final reports within the applicable deadlines
Reports are submitted through the CRA Single Reporting Platform operated by ENISA.
CRA Implementation Timeline
The Cyber Resilience Act entered into force on 10 December 2024, with its requirements becoming applicable in stages.
Two particularly important milestones are the introduction of mandatory vulnerability and incident reporting in September 2026 and the general application of the CRA's main requirements in December 2027.
Entry into Force
Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force.
Provisions on Notified Bodies Apply
Chapter IV, concerning the notification of conformity assessment bodies, became applicable.
Mandatory Reporting Requirements Apply
Manufacturers became subject to mandatory reporting obligations for actively exploited vulnerabilities and severe security incidents affecting their products.
General Application of the CRA
The CRA's main requirements become applicable, including essential cybersecurity requirements, conformity assessment procedures, and CE marking obligations.
Why Early Preparation Matters
The reporting obligations applicable from 11 September 2026 also extend to covered products placed on the EU market before 11 December 2027.
Manufacturers should therefore establish appropriate vulnerability management and incident reporting processes without waiting for the CRA's general application date.
Companies planning to place covered products on the EU market from December 2027 should also prepare the required technical documentation and conformity assessment procedures in advance.
How to Prepare for CRA Compliance
Preparing for the CRA involves several interconnected activities, from determining whether products fall within its scope to implementing cybersecurity requirements, demonstrating conformity, and maintaining security after products enter the market.
A structured approach helps companies identify the relevant obligations, prioritize necessary improvements, and establish sustainable compliance processes.
Determine Product Scope and Applicable Requirements
Identify which products fall within the scope of the CRA. Determine their regulatory classification, the company's role in the supply chain, and the cybersecurity obligations that apply.
Assess Your Current Compliance Gaps
Review existing development practices, cybersecurity controls, vulnerability management processes, and technical documentation. Compare these against the CRA's requirements to identify areas requiring improvement.
Implement Security Measures and Processes
Address identified gaps by strengthening product security, preparing technical documentation and SBOMs, and establishing processes for vulnerability handling, security updates, and incident reporting.
Demonstrate Conformity and Maintain Compliance
Complete the applicable conformity assessment procedures, prepare the EU Declaration of Conformity, and fulfil CE marking requirements. Continue managing vulnerabilities and providing security updates throughout the required support period.
Frequently Asked Questions
Does the CRA apply to companies outside the EU?
Yes. The CRA can affect manufacturers established outside the European Union if they make covered products available on the EU market. The applicable obligations depend on the product and the company's role as a manufacturer, importer, or distributor.
Does the CRA apply to software?
Yes. The CRA covers both hardware and software products with digital elements. Whether a specific software product falls within its scope depends on factors such as its intended purpose, functionality, and how it is made available on the market.
When do companies need to comply with the CRA?
Most of the CRA's requirements become applicable on 11 December 2027. However, mandatory reporting obligations for actively exploited vulnerabilities and severe security incidents have applied since 11 September 2026.
Where should companies start with CRA compliance?
A practical starting point is to determine which products fall within the CRA's scope and identify the applicable requirements. Companies should then evaluate their existing development and security processes, identify compliance gaps, and prioritize the measures needed to address them.
Is CE marking required under the CRA?
Yes. Products subject to the CRA must undergo the applicable conformity assessment procedure and meet the relevant requirements before the CE marking is affixed.
The assessment procedure depends on factors such as product classification. Certain products may require the involvement of a notified body.
Does the CRA require a Software Bill of Materials?
Yes. The CRA requires manufacturers to identify and document the components contained in their products, including by preparing and maintaining a Software Bill of Materials (SBOM) covering at least the top-level dependencies.
However, the CRA does not impose a blanket requirement to make the complete SBOM publicly available. Manufacturers must manage this information in accordance with the applicable documentation and disclosure requirements.
Cyber Resilience Act – Legal Text
For a detailed understanding of the CRA's requirements and obligations, it is important to refer to the provisions of Regulation (EU) 2024/2847.
Enobyte provides access to the Cyber Resilience Act in English, allowing businesses and professionals to explore its provisions and better understand their regulatory obligations.
Cyber Resilience Act (CRA) – Full Legal Text
Explore the provisions of Regulation (EU) 2024/2847, with convenient access to individual articles through the table of contents.
Read the Cyber Resilience Act →CRA Compliance Enquiries
Preparing for the Cyber Resilience Act requires companies to understand which products are affected, evaluate their existing cybersecurity practices, and identify the measures needed to meet the applicable requirements.
Enobyte welcomes enquiries relating to EU cybersecurity regulations, including questions about the CRA's scope, regulatory obligations, and practical compliance considerations.
If you would like to discuss how the CRA may affect your products or business operations, please contact us.
This page provides a general overview of the Cyber Resilience Act and does not constitute a product-specific legal or regulatory assessment. Applicability and compliance obligations should be evaluated in light of the relevant product characteristics and business model.