CRA Obligations for Manufacturers
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, binds manufacturers of products with digital elements for the entire product lifecycle. That lifecycle runs from the first concept to the end of support. Article 13 of the CRA sets out the core obligations of manufacturers. It defines what you must do before placing a product on the market and which responsibilities continue afterwards. This page groups the CRA manufacturer obligations into five areas and shows how they connect to the other obligations of the Cyber Resilience Act.
Contents
What the CRA requires from manufacturers
Article 13 is the core of the manufacturer obligations. It follows a lifecycle logic: the cybersecurity of a product is not checked only at the point of sale. It is built in during design and development and maintained throughout the support period. The paragraphs of Article 13 fall into five areas, explained one by one below.
| Area | Core obligation |
|---|---|
| Risk-based approach | Design, develop, and produce the product securely; assess its cybersecurity risks and take the outcome into account in all phases. |
| Lifecycle responsibility | Handle vulnerabilities effectively, provide security updates, and determine the support period. |
| Reporting | Report vulnerabilities in components to those responsible for them, document cybersecurity aspects, and inform authorities on request. |
| Transparency | Draw up the technical documentation and the EU declaration of conformity, affix the CE marking, and inform users. |
| Secure supply chain | Exercise due diligence when integrating third-party components and keep the software bill of materials (SBOM) available. |
Template for your vulnerability disclosure policy
Coordinated vulnerability disclosure is a mandatory part of vulnerability handling. Our free template helps you set up your own policy.
Risk-based approach and secure development lifecycle
Article 13(1) to (4) of the CRA requires that a product with digital elements is designed, developed, and produced in line with the essential cybersecurity requirements in Annex I, Part I. Security is therefore not a feature you add later. It must be built in from the start. IEC 62443-4-1 describes how such a secure development process can be set up.
What does a risk-based approach mean in practice?
Take a connected embedded controller with a web interface. The risk assessment starts at the design stage, because the web interface opens up an attack surface. Its risks must be considered over the expected period of use and taken into account in every phase.
To meet this obligation, you as a manufacturer must assess the cybersecurity risks associated with the product. The outcome of this assessment feeds into every phase: planning, design, development, production, delivery, and maintenance. The goal is to minimize risks, prevent incidents, and minimize their impact, including on the health and safety of users.
What must the risk assessment contain?
The risk assessment is not static. You must document it and update it as appropriate during the support period. At a minimum, it contains an analysis of cybersecurity risks based on the intended purpose and the reasonably foreseeable use of the product. This analysis takes into account how long the product is expected to be in use. The assessment also states whether and how the individual security requirements of Annex I apply to the product and how they are implemented.
When placing the product on the market, you must include the risk assessment in the technical documentation required by Article 31 and Annex VII. If certain essential cybersecurity requirements do not apply to the product, the same documentation must contain a clear justification. In other words, if you leave out a requirement, you must justify that decision.
The detailed technical and process requirements behind Annex I are a topic of their own and are not covered on this page.
Responsibility across the lifecycle
Your responsibility as a manufacturer does not end when the product is placed on the market. In many respects, it starts there. Article 13(8) to (11), (21), and (23) set out how long and to what extent you must maintain a product after it is sold.
At their core, these are post-market obligations. They include providing security updates, determining the support period, taking corrective measures in case of non-conformity, and informing others if you cease operations.
How long must manufacturers provide security updates?
When placing the product on the market and for the support period, you must ensure that vulnerabilities in the product and its components are handled effectively. This must happen in accordance with Annex I, Part II. You determine the support period yourself, so that it reflects how long the product is expected to be in use. Relevant factors include reasonable user expectations, the nature of the product, and relevant Union law on the lifetime of products.
The support period must be at least five years. If the product is expected to be in use for less than five years, the support period corresponds to the expected use time. Where market surveillance data suggests inadequate support periods, the Commission can set a minimum support period for specific product categories by delegated acts.
The availability of updates is a separate obligation. Each security update made available to users during the support period must remain available after it was issued. The minimum is 10 years or the remainder of the support period, whichever is longer.
Software products benefit from a simplification. Suppose you have placed substantially modified versions of a software product on the market. You may then ensure compliance with the relevant requirement only for the version you placed on the market last. This applies only if users of earlier versions can access the latest version free of charge. They must also not incur additional costs to adjust their hardware and software environment. If you maintain public software archives with historical versions, you must inform users clearly and in an easily accessible way about the risks of unsupported software.
What applies in case of non-conformity?
If you know or have reason to believe that your product or your processes do not meet the essential cybersecurity requirements, you must immediately take the necessary corrective measures. Depending on the situation, you bring the product into conformity, withdraw it, or recall it.
The obligation to handle vulnerabilities is tied to the support period you determine, not to a longer product lifetime.
What applies when a manufacturer ceases operations?
The end of business operations is also covered. A manufacturer that ceases its operations and can therefore no longer comply with the CRA must inform the relevant market surveillance authorities before the cessation takes effect. To the extent possible, it must also inform the users of the affected products of the impending cessation, by any means available.
Is your vulnerability handling process ready for the CRA?
Not sure whether your processes for vulnerability handling, update delivery, and support periods meet the manufacturer obligations? A short call clarifies where your product stands.
Reporting vulnerabilities and informing authorities
Article 13(6), (7), and (22) cover communication with the outside world: with those responsible for individual components and with authorities. Do not confuse these obligations with the reporting obligations to CSIRTs and ENISA. The end of this section explains the difference.
How do manufacturers report vulnerabilities in components?
When you identify a vulnerability in an integrated component, including an open-source component, you must report it to the person or entity that manufactures or maintains the component. You must also address and remediate the vulnerability in line with Annex I, Part II. If you have developed a software or hardware modification to fix the vulnerability, you must share the relevant code or documentation with those responsible for the component. Where appropriate, you share it in a machine-readable format.
What must be documented and provided to authorities?
In parallel, you must systematically document all relevant cybersecurity aspects of the product. These include vulnerabilities you become aware of and relevant information provided by third parties. Where applicable, you update the risk assessment. These obligations also include a policy for coordinated vulnerability disclosure under Annex I, Part II. You use it to process and remediate vulnerabilities reported from internal or external sources.
You must also cooperate with authorities. On a reasoned request from a market surveillance authority, you must provide all information and documentation needed to demonstrate conformity. You must cooperate with the authority on any measures to eliminate the cybersecurity risks posed by your product.
How does this differ from the CRA reporting obligations?
This reporting is separate from the reporting obligations to authorities for actively exploited vulnerabilities and severe incidents. The early warning notification within 24 hours and the subsequent notifications and reports are not part of the manufacturer obligations in Article 13. They are separate reporting obligations, covered on the page on CRA reporting obligations.
Transparency, CE marking, and user information
Article 13(12) to (20) make conformity visible to the outside world. They also ensure that users receive the information they need to operate the product securely.
When is the CE marking affixed?
Before placing the product on the market, you must draw up the technical documentation under Article 31. You must carry out the conformity assessment under Article 32 or have it carried out. Once conformity has been demonstrated, you draw up the EU declaration of conformity under Article 28. You then affix the CE marking under Article 30. The CE marking is the visible end point of this process, not a separate step.
Which documents must manufacturers keep?
Several information and retention obligations follow from this. You must keep the technical documentation and the EU declaration of conformity for at least 10 years or for the support period, whichever is longer. For series production, you must have procedures in place so that the products remain in conformity. Each product must bear a type, batch, or serial number or another element allowing its identification.
You must also provide your contact details and designate a single point of contact. Users can use it to communicate with you directly and rapidly, including to report vulnerabilities.
What information must users receive?
The information and instructions to the user under Annex II must accompany the product. You must keep them available for at least 10 years or for the support period, whichever is longer. The end date of the support period must be easily accessible at the time of purchase, stating at least the month and year. Finally, you must provide a copy of the EU declaration of conformity or a simplified EU declaration of conformity with the product. A simplified declaration must state the internet address of the full declaration.
| Document or item | Minimum period |
|---|---|
| Technical documentation and EU declaration of conformity | 10 years or the support period, whichever is longer |
| Information and instructions to the user | 10 years or the support period, whichever is longer |
| Availability of security updates already provided | 10 years or the remainder of the support period, whichever is longer |
| Support period itself | at least 5 years (or the expected use time, if shorter) |
Secure supply chain, components, and SBOM
Few products with digital elements are built without third-party components. Article 13(5), (24), and (25) therefore address the supply chain.
What due diligence applies to third-party components?
When you integrate components sourced from third parties, you must exercise due diligence so that they do not compromise the cybersecurity of the product. This explicitly includes free and open-source software that has not been made available in the course of a commercial activity.
What is an SBOM and what is it for?
The SBOM is a central tool for transparency in the supply chain. The Commission can specify the format and elements of the SBOM by implementing acts, taking into account European and international standards. The dedicated administrative cooperation group (ADCO) can also decide to conduct a Union-wide assessment of dependencies on software components for specific product categories. For that purpose, market surveillance authorities can request the manufacturers concerned to provide their SBOMs.
Where do manufacturer obligations end?
Manufacturer obligations end where the obligations of downstream economic operators begin. Before placing a product on the market or making it available, importers and distributors check, among other things, whether the CE marking is affixed. The page on CRA obligations for importers and distributors explains what applies to them.
The penalties show how far these obligations reach. Infringements of the manufacturer obligations fall under the highest penalty tier of the CRA. Administrative fines can reach €15 million or 2.5% of total worldwide annual turnover, whichever is higher. The page on CRA penalties explains the tiers and how fines are calculated.
To see where the manufacturer obligations fit into the wider body of EU cybersecurity regulation, read our overview of the relevant EU acts.
Which manufacturer obligations apply to your products?
CRA obligations range from risk assessment through documentation and CE marking to post-market support. A call helps clarify which of them your product line already needs to implement today.