Cyber Resilience Act FAQ
This page answers the most common questions about the Cyber Resilience Act (CRA) for manufacturers and other companies that sell products with digital elements in the EU. As the first horizontal regulation for these products, the CRA brings new cybersecurity tasks and raises many questions. The answers cover the basics, specific requirements, and practical implementation. We update them regularly.
Contents
- General questions
- How the CRA compares with other EU laws
- Timeline and transition periods
- Scope
- Which products does the Cyber Resilience Act cover?
- Does the CRA apply to software?
- Are there exclusions from the CRA?
- Does the CRA apply to radio equipment?
- Does the CRA apply to small and medium-sized enterprises (SMEs)?
- Does the CRA apply to companies outside the EU?
- Does the CRA apply to distributors and online marketplaces?
- Does the CRA apply to open-source software?
- Conformity
- Which product categories does the CRA distinguish?
- How are conformity assessment bodies involved?
- What does “placing on the market” mean under the CRA?
- What does “making available on the market” mean, and how does it differ from placing on the market?
- Does existing software have to be made CRA-compliant retroactively?
- What counts as a substantial modification of a product?
- What role do updates and new software versions play?
- Updates
- Implementation
- How can you prepare for the Cyber Resilience Act?
- What happens if you do not comply with the Cyber Resilience Act?
- Do you need vulnerability handling even if you have not had it so far?
- What reporting obligations apply to actively exploited vulnerabilities?
- What does security by design mean under the CRA?
- Is an existing IEC 62443 or ISO/IEC 27001 certification enough for the CRA?
- What role does the technical documentation play under the CRA?
General questions
What is the Cyber Resilience Act?
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, is an EU regulation that sets minimum requirements for the cybersecurity of products, both hardware and software. Its aim is to make products more secure and so protect consumers and businesses better against cyberattacks.
What does the CRA mean for products?
The CRA defines security requirements for products with digital elements. It is meant to ensure that products meet basic cybersecurity requirements from development to the end of their lifetime.
Why was the CRA introduced?
The EU introduced the CRA to improve the cybersecurity of products with digital elements in the EU. It responds to the growing threat of cyberattacks, which are often made possible by poorly secured products.
Is the CRA a regulation or a directive?
The CRA is a regulation. It applies directly in all EU Member States, and Member States do not have to transpose it into national law.
How the CRA compares with other EU laws
Cyber Resilience Act vs. NIS2
The CRA and the NIS2 Directive (Directive (EU) 2022/2555) have different focuses:
- The CRA covers the cybersecurity of products with digital elements. It sets requirements for manufacturers, importers, and distributors.
- NIS2 applies to companies and organizations in critical and important sectors, such as energy or health care. It requires organizational and technical security measures.
The CRA applies directly as a regulation, while Member States must transpose NIS2 into national law. The two complement each other: the CRA strengthens product security, and NIS2 strengthens organizational security.
Cyber Resilience Act vs. DORA (Digital Operational Resilience Act)
The CRA and the Digital Operational Resilience Act (DORA) differ in focus and scope:
- The CRA covers the cybersecurity of products with digital elements. It sets requirements for manufacturers, importers, and distributors so that these products are developed, operated, and maintained securely. Its aim is to improve security in all industries that use such products.
- DORA is specific to the financial sector. It regulates the digital operational resilience of financial entities such as banks, insurers, and payment service providers. DORA aims to minimize the risks of cyberattacks and IT outages. Among other things, it requires clear rules for IT risk management and incident reporting.
The CRA applies across all industries, while DORA was designed for the financial sector. The two complement each other by addressing different aspects of cybersecurity.
Cyber Resilience Act vs. Cybersecurity Act
The CRA and the Cybersecurity Act (Regulation (EU) 2019/881), or CSA, have different focuses:
- The CRA sets cybersecurity requirements for products with digital elements. It requires manufacturers to follow secure development processes, fix vulnerabilities, and provide security updates. Its aim is to raise product security across the EU.
- The CSA creates the framework for European cybersecurity certification. It sets general rules and requirements for certification schemes, such as the EUCC scheme based on the Common Criteria. It also strengthens the role of ENISA, the European Union Agency for Cybersecurity.
The CRA defines mandatory security requirements for products. The CSA focuses on voluntary certification to assess the cybersecurity of products, services, and processes.
Timeline and transition periods
Is the Cyber Resilience Act in force?
Yes. The CRA entered into force on December 10, 2024. Its obligations apply in stages:
| Date | What applies |
|---|---|
| Dec 10, 2024 | Entry into force |
| Sep 11, 2026 | Certain provisions, in particular the reporting obligations for vulnerabilities |
| Dec 11, 2027 | The main obligations, such as compliance with the cybersecurity requirements and CE marking |
These staggered transition periods are meant to give economic operators enough time to implement the new requirements.
When does the CRA apply?
The CRA has been in force since December 10, 2024. Most requirements, such as implementing cybersecurity measures, apply only from December 11, 2027. The reporting obligations for vulnerabilities have applied since September 11, 2026.
By when must you comply with the CRA?
You must meet the CRA requirements by December 11, 2027 at the latest, because all requirements apply from that date. The reporting obligation for vulnerabilities came earlier: it has applied since September 11, 2026.
Scope
Which products does the Cyber Resilience Act cover?
The CRA applies to all products with digital elements that are placed on the market in the EU. This includes both hardware and software, whether intended for consumers or for businesses.
There are exclusions for certain products that already fall under other specific EU rules, such as medical devices or vehicles, because their cybersecurity requirements are regulated separately. For the criteria in detail, see CRA scope and exclusions.
Does the CRA apply to software?
Yes. The CRA expressly applies to software and software products made available in the EU. Software-only products are products with digital elements too, unless they are expressly excluded (for example, certain open-source software that is not provided commercially). The CRA does not fundamentally distinguish between hardware and software manufacturers.
Covered software includes operating systems, application software, middleware, and even open-source software if it is distributed commercially.
Are there exclusions from the CRA?
The CRA does not apply to products that are already subject to specific cybersecurity requirements under other EU rules. These include:
- Medical devices (regulated by the Medical Device Regulation)
- Vehicles (covered by the type-approval regulations)
- Aviation products
- Military products
These exclusions avoid double regulation, because these products must already meet cybersecurity requirements under their own sector rules.
Does the CRA apply to radio equipment?
The CRA also applies to radio equipment if it is a product with digital elements. Until December 10, 2027, certain radio equipment must meet the cybersecurity requirements of the Radio Equipment Directive (Directive 2014/53/EU), or RED, set out in Commission Delegated Regulation (EU) 2022/30. The CRA reporting obligations have applied alongside them since September 11, 2026.
Commission Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from December 11, 2027. From then on, the CRA replaces the cybersecurity requirements of the RED, so a single set of rules applies to products with digital elements.
Does the CRA apply to small and medium-sized enterprises (SMEs)?
The CRA applies to all companies that manufacture, import, or distribute products with digital elements in the EU, including small and medium-sized enterprises (SMEs). There are no general exemptions for SMEs. However, the CRA takes the needs of smaller companies into account and aims to keep their administrative burden low.
Does the CRA apply to companies outside the EU?
Yes. The CRA also applies to manufacturers outside the EU as soon as their products with digital elements are placed or made available on the EU market.
In addition, a product may only be made available on the Union market if an economic operator established in the EU takes on certain market surveillance tasks. These include checking the EU declaration of conformity and the technical documentation and cooperating with the authorities. If you as a manufacturer are not established in the EU, you therefore need an importer. Alternatively, you need an authorized representative or, if there is no one else, a fulfillment service provider.
Does the CRA apply to distributors and online marketplaces?
Yes, the CRA also applies to distributors that sell products with digital elements in the EU. They are responsible for making sure that the products they sell meet the CRA requirements. Online marketplaces are covered only where they act as an economic operator themselves, for example when they sell a product as a distributor. A provider that merely intermediates sales by third parties is not an economic operator under the CRA (Recital 78 of the CRA).
In particular, distributors must check that products bear the CE marking, have an EU declaration of conformity, and come with the required security information.
Does the CRA apply to open-source software?
The CRA does not apply to free and open-source software that is not made available on the market in the course of a commercial activity. What counts is how the software is made available, not how it was developed. Who developed the software and how its development was funded do not matter. If its manufacturer does not monetize the software, it generally does not fall under the obligations of manufacturers under the CRA.
It is different if the software is made available in the course of a commercial activity. Examples are supply for a price or paid support services that go beyond cost recovery. The provider is then a manufacturer and must meet the CRA requirements.
If open-source software is only integrated as a component into a product that is sold, this does not bring the open-source project under the CRA. The manufacturer of the end product is responsible and must select and integrate the component with due diligence. Foundations and other legal persons that support such software on a sustained basis for commercial purposes, without making it available themselves, are open-source software stewards. They have lighter obligations of their own.
For more on this topic, see our article The Cyber Resilience Act and open-source software.
Conformity
Which product categories does the CRA distinguish?
The CRA distinguishes products with digital elements solely by the conformity assessment procedure that applies. The technical and process requirements are the same for all products.
The categories are:
- Default products
- Important products, class I
- Important products, class II
- Critical products
For details on each category and the related conformity assessment procedures, see our Cyber Resilience Act overview.
How are conformity assessment bodies involved?
Under the CRA, conformity assessment bodies are involved for certain product categories to check compliance with the cybersecurity requirements. This applies to products for which the manufacturer's self-assessment is not enough.
They are involved in particular for:
- Important products, class I, if the manufacturer has not fully applied harmonized standards, common specifications, or European cybersecurity certification schemes at assurance level at least “substantial”. The same applies if none of these exist (Article 32(2) of the CRA).
- Important products, class II
- Critical products
In these cases, a notified body reviews the technical documentation and, where applicable, the product itself before it may be placed on the market. For more on the conformity assessment procedures, see our Cyber Resilience Act overview.
What does “placing on the market” mean under the CRA?
A product is placed on the market when it is made available on the EU market for the first time. This can happen through sale, rental, or other forms of commercial supply. Making free software available for the first time as part of a commercial activity can also count as placing on the market.
What does “making available on the market” mean, and how does it differ from placing on the market?
Making available on the market means any supply of a product for distribution, consumption, or use on the EU market. Placing on the market is the first of these steps. Later updates or new versions can also count as making the product available again.
Does existing software have to be made CRA-compliant retroactively?
As a rule, the CRA applies only to products that are newly placed on the market, or substantially modified, after its date of application. Existing products without a substantial modification do not have to be adapted retroactively. Other applicable laws, such as product liability law, still apply to them.
There is one exception: the reporting obligations under Article 14 apply to all products with digital elements within the scope of the CRA. This includes products placed on the market before December 11, 2027 (Article 69(3) of the CRA). These obligations have applied since September 11, 2026.
What counts as a substantial modification of a product?
A substantial modification exists when a change significantly alters the cybersecurity properties or the intended purpose of a product. In that case, the product counts as newly placed on the market from a regulatory point of view and must fully comply with the CRA.
What role do updates and new software versions play?
Security updates generally do not count as a substantial modification. Feature updates or new versions can, however, be a substantial modification if they introduce new risks or change existing security assumptions.
Updates
Do you have to provide updates for your products?
Manufacturers must provide security updates during a support period. This support period must be at least five years. If the product can reasonably be expected to be in use for longer than five years, a longer support period is required. The minimum of five years is then not enough.
A support period shorter than five years is justified only if the product is actually expected to be in use for less than five years. Examples are highly purpose-specific software or certain subscription models.
Can you charge for security updates?
As a rule, the CRA does not allow you to charge extra for security updates. Security updates that fix identified vulnerabilities must be provided without delay and free of charge.
For a tailor-made product with digital elements, however, the manufacturer and the business user can agree otherwise. In that case, they can agree on charges for security updates, provided this is explicitly set out in the contract.
Implementation
How can you prepare for the Cyber Resilience Act?
To prepare for the CRA, manufacturers should take these steps:
- Determine the product category
Find out which category your products fall into (default, important, critical) and which conformity assessment procedure applies. - Adapt your processes
Implement a secure product development process that meets the CRA requirements, for example in line with IEC 62443-4-1. - Meet the technical requirements
Implement security functions based on a risk assessment so that you address potential threats effectively. - Prepare the technical documentation
Create the evidence and documentation that will be reviewed in the conformity assessment procedure.
What happens if you do not comply with the Cyber Resilience Act?
Failure to comply with the CRA can have serious consequences, including:
- Sales ban
Products that do not meet the CRA requirements must not be sold or placed on the market in the EU. - Recall or withdrawal
The competent authorities can recall products that are already on the market, or withdraw them from the market, if they do not comply. - Fines
The CRA provides for high administrative fines, which can depend on the severity of the infringement. The maximum is €15 million or 2.5% of worldwide annual turnover, whichever is higher.
Do you need vulnerability handling even if you have not had it so far?
Yes. The CRA requires manufacturers to set up and maintain a structured vulnerability handling process. It covers, among other things, receiving vulnerability reports, assessing and fixing them, and informing users and authorities.
What reporting obligations apply to actively exploited vulnerabilities?
Manufacturers must report an actively exploited vulnerability within 24 hours of becoming aware of it, with an early warning notification. The report goes simultaneously to the CSIRT designated as coordinator and to ENISA, through the single reporting platform (Article 14(1) and (2)(a) of the CRA). In addition, manufacturers must pass relevant information on to affected users where this is necessary to reduce the risk.
What does security by design mean under the CRA?
Security by design means that cybersecurity is built into product design and development systematically from the start. This includes secure default settings, a minimal attack surface, secure update mechanisms, and protection of sensitive data.
Is an existing IEC 62443 or ISO/IEC 27001 certification enough for the CRA?
No, not automatically. Existing standards can help you cover many CRA requirements, but they do not replace a CRA-specific assessment. Manufacturers must demonstrate that they meet all relevant CRA requirements, regardless of existing certifications.
What role does the technical documentation play under the CRA?
The technical documentation is a central part of the conformity assessment. Among other things, it must describe the product, its security functions, the development process, and the protective measures taken in a way that others can follow. It must be available to market surveillance authorities.
Not sure where you stand on these steps?
Preparing for the CRA involves several building blocks, from the product category and adapted processes to the technical documentation. In a short call, we can look at which of them are already in place for your products and where work remains.