The EU Cyber Resilience Act
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, sets binding cybersecurity requirements for almost all products with digital elements placed on the EU market. Its general obligations apply from December 11, 2027. The regulation makes the manufacturer responsible for product security across the whole lifecycle, from the risk assessment to vulnerability handling after the product is on the market.
The CRA is a horizontal EU regulation with uniform requirements for hardware and software products. It covers security requirements, the obligations of manufacturers, importers, and distributors, the reporting of vulnerabilities and incidents, and conformity assessment followed by CE marking. It entered into force on December 10, 2024.
Contents
- The CRA at a glance
- What does the CRA cover, and what not?
- Which product classes does the CRA distinguish?
- What are the obligations of manufacturers?
- Which reporting obligations apply, and since when?
- What are the obligations of importers, distributors, and open-source software stewards?
- How do you demonstrate CRA conformity?
- Which standards support CRA implementation?
- What happens if you violate the CRA?
- Where does CRA implementation stand today?
The CRA at a glance
- The CRA applies from December 11, 2027 to almost all products with digital elements made available in the EU.
- Manufacturers are responsible throughout the support period. It must be at least five years and is usually much longer for industrial applications.
- The CRA grades conformity assessment by risk in three product classes: default, important (Annex III), and critical (Annex IV).
- Reporting obligations for actively exploited vulnerabilities and severe incidents have applied since September 11, 2026, with deadlines of 24 hours, 72 hours, and 14 days.
- Fines reach up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
What does the CRA cover, and what not?
The CRA applies to every product with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network. It covers software, hardware, and the remote data processing solutions that the manufacturer provides.
Excluded are products already covered by other EU rules with an equivalent or higher level of protection: medical devices (Regulation (EU) 2017/745), in vitro diagnostic medical devices (Regulation (EU) 2017/746), motor vehicle type approval (Regulation (EU) 2019/2144), civil aviation (Regulation (EU) 2018/1139), and marine equipment (Directive 2014/90/EU). Spare parts with identical specifications are also excluded, as are products developed exclusively for national security or defense.
Free and open-source software and cloud or SaaS solutions are special cases. Open-source software is only in scope if it is made available on the market in the course of a commercial activity. SaaS offerings are only covered to the extent that they count as a remote data processing solution of a product with digital elements.
Further reading: CRA scope in detail · The CRA and open-source software · MDR reporting obligations: the EU closes the CRA gap for medical devices · The CRA and the Machinery Regulation
Which product classes does the CRA distinguish?
The CRA grades its requirements by the risk a product poses. It distinguishes three classes:
- Products with digital elements must meet the essential cybersecurity requirements in Annex I and go through the manufacturer's internal control. The large majority of products covered by the CRA fall into this class.
- Important products with digital elements are listed in Annex III and divided into two classes. The list includes products whose core functionality is critical to the cybersecurity of other products or networks, or products with a significant risk potential, for example as a central system function. Class I includes identity and access management, anti-malware software, network management systems, operating systems, and routers and switches, among others. Class II includes hypervisors and container runtime systems, firewalls, intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers.
- Critical products with digital elements are listed in Annex IV. A delegated act of the Commission can require them to obtain a European cybersecurity certificate under the Cybersecurity Act at assurance level at least “substantial”.
The Commission set out the technical descriptions of the categories in Annexes III and IV in Commission Implementing Regulation (EU) 2025/2392 of November 28, 2025. What counts is the core functionality of a product. Integrated components do not change the classification of the product as a whole.
Further reading: CRA product categories · Commission Implementing Regulation (EU) 2025/2392 · Cybersecurity Act
What are the obligations of manufacturers?
Article 13 of the CRA sets out the obligations of manufacturers. In practice, they fall into four areas:
- Risk management. Manufacturers must carry out a cybersecurity risk assessment that covers the product from design to maintenance. They must document it, update it regularly, and include it in the technical documentation under Annex VII.
- Vulnerability handling. Manufacturers must handle vulnerabilities effectively during the support period, including vulnerabilities in integrated third-party components and open-source components. The manufacturer sets the support period so that it reflects the time the product is expected to be in use. It must be at least five years, unless the product is expected to be in use for a shorter time. For long-lived industrial products, such as machinery or plant equipment, it should be correspondingly longer. Each security update made available during the support period must remain available for at least 10 years or for the remainder of the support period, whichever is longer.
- Technical documentation and conformity assessment. Before placing a product on the market, manufacturers must draw up the technical documentation, carry out the chosen conformity assessment procedure, issue the EU declaration of conformity, and affix the CE marking. They must keep the technical documentation and the declaration of conformity for at least 10 years or for the support period, whichever is longer.
- Obligations after placing on the market. Manufacturers must show an identification number, their contact details, and the end date of the support period where users can see them. They must designate a single point of contact, take corrective action without delay if a product does not conform, and cooperate with market surveillance authorities.
Further reading: Obligations of manufacturers under the CRA (Article 13) · Support period and security updates under the CRA · CRA templates
Not sure where your product stands?
In a short call, we look at where your organization and your products stand against the CRA requirements and where the biggest gaps are.
Which reporting obligations apply, and since when?
Manufacturers must report actively exploited vulnerabilities and severe incidents to the CSIRT designated as coordinator and to ENISA through the single reporting platform. Reporting runs in three stages:
| Stage | Deadline |
|---|---|
| Early warning notification | within 24 hours of becoming aware |
| Detailed notification (vulnerability or incident notification) | within 72 hours |
| Final report | within 14 days after a corrective or mitigating measure is available (vulnerabilities), or within one month after the incident notification (incidents) |
An incident is severe if it affects, or could affect, the product's ability to protect the availability, authenticity, integrity, or confidentiality of sensitive or important data or functions, or if it has led or could lead to the introduction of malicious code. Manufacturers must also inform affected users about the vulnerability or incident and about possible mitigation measures.
The reporting obligations were the first CRA obligations to take effect. They have applied since September 11, 2026, more than a year before the regulation applies in full.
Further reading: CRA reporting obligations (Article 14) · CRA reporting obligations for products already on the market · CRA transition periods at a glance
What are the obligations of importers, distributors, and open-source software stewards?
Importers may only place products on the market that meet the essential requirements. They must check the conformity assessment, the technical documentation, and the CE marking, put their contact details on the product or its packaging, and cooperate with market surveillance authorities.
Distributors must check, before making a product available, that it bears the CE marking and comes with the required information. If they suspect that a product does not conform, they must not make it available and must inform the manufacturer and the authorities.
Open-source software stewards are legal persons that support open-source projects without monetizing them. They must put in place a cybersecurity policy, cooperate with market surveillance authorities, and report vulnerabilities to the extent that they are involved in development. Their obligations are much lighter than those of commercial manufacturers.
Further reading: Obligations of importers and distributors under the CRA · The CRA and open-source software
How do you demonstrate CRA conformity?
Article 32 of the CRA provides four routes to demonstrate conformity. Annex VIII describes them in detail:
- Module A, internal control: the manufacturer assesses conformity itself, without a notified body.
- Modules B and C, EU-type examination followed by conformity to type based on internal production control: a notified body examines the design, and the manufacturer then controls series production internally.
- Module H, full quality assurance: a notified body assesses the manufacturer's entire quality management system.
- European cybersecurity certificate: under the Cybersecurity Act, for example under the EUCC scheme (Common Criteria, ISO/IEC 15408).
Which procedure you may use depends on the product class and on whether you have applied harmonized standards in full. If you apply a harmonized standard in full, your product benefits from a presumption of conformity with the corresponding essential requirements. For important products in class I, internal control under module A then remains available.
| Product class | Module A | Modules B+C | Module H | Cybersecurity certificate |
|---|---|---|---|---|
| Default | ✓ | ✓ | ✓ | ✓ |
| Important, class I (Annex III) | ✓¹ | ✓ | ✓ | ✓ |
| Important, class II (Annex III) | ✓ | ✓ | ✓ | |
| Critical (Annex IV) | ✓² | ✓² | ✓ |
¹ Only if a harmonized standard is applied in full. ² Only if no delegated act requires a cybersecurity certificate for the product category.
Further reading: CRA conformity assessment (Article 32) · CE marking · Notified bodies · ISO/IEC 15408 Common Criteria
Which standards support CRA implementation?
The European Commission has issued standardization request M/606 to the European standardization organizations CEN, CENELEC, and ETSI. It covers a large package of horizontal standards that apply to all products with digital elements and vertical standards for individual product categories from the annexes. The presumption of conformity applies once a standard is cited in the Official Journal of the EU.
Horizontal framework: the EN 40000 series. The joint CEN and CENELEC working group CEN/CLC/JTC 13/WG 9 develops it. It provides the overarching framework for all products:
- EN 40000-1-1 Vocabulary
- EN 40000-1-2 Principles for cyber resilience
- EN 40000-1-3 Vulnerability handling
- EN 40000-1-4 Generic security requirements (catalog of technical requirements)
- technical reports on threats, security objectives, and application guidance
Vertical framework: ETSI EN 304 6xx for IT and consumer products. The ETSI series covers browsers (EN 304 617), password managers (618), anti-virus software (619), VPN (620), network management (621), SIEM (622), boot managers (623), PKI (624), network interfaces (625), operating systems (626), routers and switches (627), smart home assistants (631), smart home security products (632), connected toys (633), wearables (634), hypervisors and container runtimes (635), firewalls and IDPS (636), and telecom network functions (642).
Vertical framework: the EN 50770 series for OT applications. For selected product categories, parallel OT profiles build on the IEC 62443 series. They cover VPN (EN 50770-4), network management (50770-2), SIEM (50770-6), network interfaces (50770-3), routers and switches (50770-5), and firewalls and IDPS (50770-1). Manufacturers with OT or industrial applications can use these profiles instead of the ETSI profiles.
Hardware and microelectronics. Further standards are being developed for microprocessors, microcontrollers, ASICs, and FPGAs with security functions, for tamper-resistant components, and for smartcard platforms (EN 50764 to EN 50767), as well as EN 18330 for the smartcard application layer.
Bridging standards. Until the harmonized standards are published, you can address the requirements with established standards: IEC 62443-4-1 for secure development processes, IEC 62443-4-2 for technical component requirements, EN 18031 for radio products under the Radio Equipment Directive (RED), and ETSI EN 303 645 for consumer IoT.
Further reading: Harmonized standards for the CRA · Horizontal standards: the EN 40000 series · ETSI draft standards for the CRA · IEC 62443 for CRA compliance · ENISA mapping of the CRA to standards · IEC 62443 series · EN 18031 · ETSI EN 303 645 · CRA standardization (European Commission)
What happens if you violate the CRA?
The CRA sets three tiers of administrative fines:
| Infringement | Maximum fine |
|---|---|
| Non-compliance with the essential cybersecurity requirements in Annex I, the obligations of manufacturers, or the reporting obligations | EUR 15 million or 2.5% of worldwide annual turnover |
| Non-compliance with procedural and marking obligations, such as CE marking, EU declaration of conformity, technical documentation, or the obligations of importers and distributors | EUR 10 million or 2% |
| Incorrect, incomplete, or misleading information to notified bodies or market surveillance authorities | EUR 5 million or 1% |
In each case, the higher amount applies. When setting a fine, authorities take into account the nature, gravity, and duration of the infringement as well as the size and market share of the company.
Further reading: CRA penalties and market surveillance
Where does CRA implementation stand today?
The CRA follows a staged timeline, and some obligations for manufacturers have applied since 2026:
| Date | Milestone |
|---|---|
| Nov 20, 2024 | Publication in the Official Journal of the EU |
| Dec 10, 2024 | Entry into force |
| Jul 2, 2025 | Corrigendum to the introductory wording of Article 64(10) |
| Nov 28, 2025 | Implementing Regulation (EU) 2025/2392 specifies the product categories |
| Jun 11, 2026 | Rules on conformity assessment bodies apply |
| Sep 11, 2026 | Reporting obligations apply |
| Dec 11, 2027 | The regulation applies in full |
Standardization runs in parallel. As of October 2026, the first parts of the EN 40000 series are in the final vote. ETSI has had the final drafts of its vertical series in its approval procedure since August 2026. Depending on the standard, the procedure runs until mid-November 2026. The EN 50770 series is still at draft stage. The Commission's page on CRA standardization and ETSI's announcement of the approval procedure give the current status. Early ETSI drafts are publicly available in the ETSI Open Area.
For microenterprises and small enterprises, the EU provides funding through the SECURE project. It can pay for cybersecurity testing, consulting, and setting up processes.
Further reading: CRA transition periods at a glance · Commission Implementing Regulation (EU) 2025/2392 · EU funding for CRA compliance: the SECURE open call · Repeal of the RED delegated act · Cyber Resilience Act FAQ
The first CRA deadline was the reporting obligation
It has applied since September 11, 2026, more than a year before the CRA applies in full. If you still need a documented reporting process, our templates give you one. Roles, escalation levels, and deadline tracking are predefined; you add names and contact channels.