The CRA blog
What the Cyber Resilience Act requires, when it starts to apply and how its requirements can be met.
-
Free SBOM generator for CycloneDX and SPDX
Drawing up a software bill of materials is one of the obligations under the Cyber Resilience Act. The first one takes a few minutes to produce, free of charge, without sign-up and from files the project already contains.
Read the post: Free SBOM generator for CycloneDX and SPDX -
No CRA compliance without a product inventory
Almost every obligation in the Cyber Resilience Act attaches to the individual product. So the first question is not what has to be done but for which products. Only a product inventory answers it.
Read the post: No CRA compliance without a product inventory -
Reporting obligations from 11 September 2026
The Cyber Resilience Act does not start applying all at once. The first part that really reaches companies is the reporting obligations in Article 14, and they apply from 11 September 2026.
Read the post: Reporting obligations from 11 September 2026 -
What the Cyber Resilience Act means for businesses
The Cyber Resilience Act (CRA) sets binding cybersecurity requirements for hardware and software placed on the EU market. An overview of who the CRA affects, what it requires and which dates apply.
Read the post: What the Cyber Resilience Act means for businesses
The posts in this blog are for orientation and do not constitute legal advice. The wording of Regulation (EU) 2024/2847 prevails.