What the Cyber Resilience Act means for businesses

The CRA, Regulation (EU) 2024/2847, is meant to address two problems identified in recital 1: a low level of cybersecurity, reflected in widespread vulnerabilities and the insufficient and inconsistent provision of security updates, and users who lack the information to choose secure products and use them securely. It has been in force since 10 December 2024 and, as a regulation, applies directly in every Member State. Its obligations take effect in stages, however, and the first ones for manufacturers apply from 11 September 2026. This post gives an overview of which products the CRA covers, whom it places under obligations, what it requires and what a sensible first step looks like.

Which products the CRA covers

The CRA applies to products with digital elements: put simply, hardware and software that can connect directly or indirectly to a device or network. The range runs from connected household appliances through routers and industrial controllers to desktop software and apps. Under Article 2(1), what matters is whether the intended purpose or reasonably foreseeable use of the product includes such a data connection. Under Article 3(1), a product also includes its remote data processing solutions, and software or hardware components that are placed on the market separately count as products as well.

Products already covered by their own EU rules are excluded: medical devices and in vitro diagnostic medical devices, vehicles and vehicle parts subject to EU type-approval, certified aviation products and marine equipment (Article 2(2) to (4)). Nor does the CRA cover products developed or modified exclusively for national security or defence purposes, or products specifically designed to process classified information (paragraph 7). For cloud software, it depends on whether the software belongs to a product; the questions below go into this.

Who carries the obligations

Most obligations fall on the manufacturer. A manufacturer is anyone who develops or manufactures a product, or has it designed, developed or manufactured, and markets it under its own name or trademark, whether for payment or free of charge (Article 3(13)). Importers and distributors have their own, considerably lighter obligations (Articles 19 and 20). If they place a product on the market under their own name or trademark, Article 21 treats them as the manufacturer. Under Articles 21 and 22, the same applies to anyone who carries out a substantial modification of a product and makes it available on the market.

For legal persons that systematically and sustainably support free and open-source software intended for commercial activities without being manufacturers themselves, Article 24 provides a separate, lighter role: the open-source software steward.

The timeline

Transition periods and dates of application at a glance:

• 10 December 2024: The CRA enters into force. From that day it is law, but its obligations only apply from the dates below.
• 11 June 2026: Chapter IV, on the notification of conformity assessment bodies, applies. Notified bodies can then be designated for the CRA.
• 11 September 2026: The reporting obligations under Article 14 apply.
• 11 December 2027: All remaining obligations apply.

Reporting obligations come first

For manufacturers, one obligation applies well before the rest. From 11 September 2026, they have to report actively exploited vulnerabilities in their products and severe incidents affecting product security (Article 14). Reports go through the single reporting platform simultaneously to the CSIRT designated as coordinator and to ENISA, in three stages: an early warning without undue delay and in any event within 24 hours of becoming aware, a notification within 72 hours of becoming aware, and then a final report.

Unlike the other requirements, the reporting obligations also apply, under Article 69(3), to products placed on the market before 11 December 2027. The entire installed base is therefore covered, not just the next product generation.

What manufacturers have to do

The core of the CRA is the set of essential cybersecurity requirements in Annex I. They come in two parts:

• The product itself (Part I). It must be designed, developed and produced to ensure an appropriate level of cybersecurity based on the risks. On the basis of the risk assessment and where applicable, it must, among other things, be made available on the market without known exploitable vulnerabilities, come with a secure by default configuration and be updatable so that vulnerabilities can be addressed through security updates.
• Handling vulnerabilities (Part II). Manufacturers identify and document the components of their products, including by drawing up a software bill of materials, remediate vulnerabilities without delay and, as a rule, provide security updates free of charge. They also need a policy on coordinated vulnerability disclosure, which they put in place and enforce.

On top of this come the obligations in Article 13. The manufacturer assesses the cybersecurity risks of its product and documents the assessment, exercises due diligence for third-party components and determines a support period during which it handles vulnerabilities effectively. Under paragraph 8 the support period is at least five years, unless the product is expected to be in use for a shorter time, in which case it matches the expected use time. All of this goes into the technical documentation under Annex VII, which has to be kept for at least ten years after the product is placed on the market or for the support period, whichever is longer (paragraph 13).

Conformity assessment and CE marking

Before a product is placed on the market, the manufacturer demonstrates in a conformity assessment that it meets the requirements. Under Article 32, the procedure available depends on how the product is classified:

• Products without a special classification, meaning all products listed neither in Annex III nor in Annex IV, can be assessed by the manufacturer itself under the internal control procedure (module A).
• Important products of class I under Annex III, such as password managers, routers or operating systems, can only be self-assessed if the manufacturer fully applies harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least “substantial”. Otherwise a notified body is involved.
• Important products of class II, such as hypervisors or firewalls, cannot be assessed by the manufacturer alone. Either a notified body is involved or, where available and applicable, the manufacturer uses a European cybersecurity certification scheme at assurance level at least “substantial”.
• Critical products under Annex IV, such as smart meter gateways or smartcards, will need European cybersecurity certification once the Commission requires it under Article 8(1). Until then, the class II procedures apply to them.

Commission Implementing Regulation (EU) 2025/2392 sets out technical descriptions of the product categories in Annexes III and IV. The assessment ends with the EU declaration of conformity and the CE marking. From 11 December 2027, a product within scope may only be placed on the market with both.

Penalties for infringements

The Member States lay down the penalties and administrative fines, within the framework set by Article 64. Infringements of the essential cybersecurity requirements and of the obligations in Articles 13 and 14 are subject to fines of up to EUR 15 million or, for undertakings, up to 2.5 % of total worldwide annual turnover for the preceding financial year, whichever is higher. For a number of other obligations, including those of importers and distributors, the ceiling is EUR 10 million or 2 %. In addition, market surveillance authorities can require corrective action, a withdrawal or a recall for non-compliant products.

Where to start

There is time until 11 December 2027, but not a great deal of it when development processes, documentation and the supply chain have to be adapted. A sensible sequence looks like this:

1. An overview of the products. Which products with digital elements does the company offer, in which versions and in which Member States?
2. The role for each product. Is the company the manufacturer, an importer or a distributor, or does it count as the manufacturer because of its own trademark or a substantial modification?
3. The reporting channels. The reporting obligations apply from 11 September 2026, long before everything else. Responsibilities, round-the-clock availability and the competent CSIRT therefore come first.
4. The classification. A product without a special classification, an important product of class I or II, or a critical product? The assessment procedure depends on it.
5. The components. A software bill of materials for each product and version shows quickly whether a vulnerability affects a product, and from 11 December 2027 it is one of the obligations anyway.
6. Processes and documentation. Risk assessment, vulnerability handling, the support period and the technical documentation all need lead time, especially where a notified body is involved.