The Cyber Resilience Act
The EU’s cybersecurity rules for hardware and software products with digital elements, Regulation (EU) 2024/2847. What manufacturers must do, when each duty applies, and what software for the CRA should cover.
Reporting already applies
The CRA entered into force on 10 December 2024. Reporting has applied since 11 September 2026, also to products already on the market. Every other duty applies to units placed on the market from 11 December 2027.
A manufacturer must report each actively exploited vulnerability and each severe incident having an impact on the security of its products: an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report after that. Reports go through ENISA’s single reporting platform to the CSIRT designated as coordinator in the Member State of the main establishment.
Free checklist: the CRA on three printable pagesHow the CRA is phased in
Dates from the regulation and the European Commission’s implementation pages.
The regulation enters into force
Regulation (EU) 2024/2847 entered into force, with its duties phased in over three years.
Notified bodies
The rules on conformity assessment bodies started to apply, so that notified bodies can be designated for the products that need them.
Reporting applies
Manufacturers report actively exploited vulnerabilities and severe incidents for every product on the market, including products placed on it before the CRA.
Every other duty applies
The essential requirements, conformity assessment, the EU declaration of conformity and the CE marking apply to every unit placed on the market from this date, including new units of models already on sale.
Is the product in scope?
The CRA applies product by product, not organisation by organisation.
- Products with digital elements
- Hardware and software made available on the EU market, for payment or free of charge, including components placed on the market separately and models no longer sold that are still in use.
- Manufacturers
- The duties fall on whoever places a product on the market under their own name or trademark. Importers and distributors have duties of their own, and become manufacturers when they market a product under their own name or substantially modify it.
- Cloud and SaaS
- Software as a service is not a product under the CRA; cloud services fall under NIS2. Remote data processing is covered only where the manufacturer is responsible for it and the product cannot perform one of its functions without it.
- Excluded products
- Products covered by their own EU product rules, among them medical devices, vehicles, civil aviation and marine equipment, and products made only for national security or defence (art. 2).
- Product classes
- Default, important class I, important class II or critical, decided by the product’s core functionality (art. 7, Annexes III and IV). The class decides how conformity is assessed.
- Products already on the market
- Reporting covers them now. The other duties apply to units placed on the market from 11 December 2027, and to earlier products that are substantially modified from that date.
What manufacturers must do
Six areas of work, each with something to show for it.
Know every product
A register of every product on the market: whether the CRA covers it, its class, where it is sold and how long it is supported.
Report within 24 hours
An early warning, a notification and a final report for each actively exploited vulnerability and severe incident, and information to the users affected.
Security by design
A documented risk assessment per product and the essential requirements of Annex I Part I: no known exploitable vulnerabilities, secure defaults, access control, data protection and a limited attack surface.
Handle vulnerabilities
A software bill of materials for every version, fixes and free security updates without delay, advisories and a coordinated vulnerability disclosure policy.
Support periods
A support period of at least five years, unless the product is expected to be in use for less, and each security update kept available for at least ten years.
Conformity and CE marking
Technical documentation, a conformity assessment by a route the class allows, the EU declaration of conformity and the CE marking, kept for at least ten years.
What CRA software should cover
Most compliance tools are built around the organisation. The CRA is built around the product. These are the questions to ask.
- A register per product
- Each product with its coverage decision and the reason, its class, markets, support period, versions and variants, and whether a new version is a substantial modification.
- Deadlines that start at awareness
- 24 hours, 72 hours, 14 days and one month, counted from when the company became aware, with reminders before each report falls due.
- Report drafts for ENISA’s platform
- Drafts that follow the fields of the single reporting platform, filled in from the record, so that nobody writes from scratch under a 24-hour deadline.
- A vulnerability register
- Each vulnerability from receipt to advisory, with its severity, a target time to fix and the point at which it is judged actively exploited.
- Proof for each product
- Risk assessment, technical documentation, an SBOM for each version, the conformity route, the notified body, the EU declaration of conformity and the CE marking.
- Shared with ISO 27001 and NIS2
- Where the work is the same process, such as vulnerability management or security testing, it should count once for every framework.
- Progress that shows proof
- A figure that counts only what is proven, and keeps what applies today apart from what applies from December 2027.
The CRA next to the management system
Compeas GRC carries the CRA for manufacturers, next to ISO 27001, NIS2, SOC 2, NIST CSF 2.0 and GDPR, hosted in the EU.
Questions about the CRA
When does the Cyber Resilience Act apply?
The CRA entered into force on 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026. Every other duty, including the essential requirements, conformity assessment and CE marking, applies from 11 December 2027.
Does the CRA apply to products already on the market?
Reporting already does, for every product on the market. The other duties apply to every unit placed on the market from 11 December 2027, including new units of models already on sale, and to earlier products that are substantially modified from that date.
Does the CRA apply to SaaS?
Not as such. Software as a service is not a product with digital elements; cloud services fall under NIS2. Remote data processing is covered only where the manufacturer is responsible for it and the product cannot perform one of its functions without it.
What has to be reported, and to whom?
Each actively exploited vulnerability and each severe incident having an impact on the security of the product. An early warning within 24 hours, a notification within 72 hours and a final report: 14 days after a corrective measure is available for a vulnerability, one month after the notification for an incident. Reports go through ENISA’s single reporting platform to the CSIRT designated as coordinator.
How long must security updates be provided?
For the support period, which is at least five years unless the product is expected to be in use for less. Each security update must then stay available for at least ten years, or for the rest of the support period if that is longer.
How does the CRA relate to NIS2?
NIS2 sets cybersecurity duties for organisations in critical sectors. The CRA sets duties for products. A manufacturer can be covered by both, and the same processes, such as vulnerability management and incident handling, can serve both.
Read further at the source
This page is a summary and does not replace the regulation or the authorities’ own guidance. Always check against the source.
Reporting already applies. Is the product register ready?
Book a walkthrough, or start with the free checklist: 34 requirements in six steps on three printable pages.