The CRA aims to make cybersecurity mandatory for connected hardware and software in Europe. (Image Credit: European Commission)
Connected products like smartphones, smart home devices, software, and industrial equipment are everywhere. These collect data, connect to networks, and receive updates. However, this also puts more importance on cybersecurity. Europe’s Cyber Resilience Act (CRA) is changing that. It makes cybersecurity mandatory for digital products sold in the EU.
The CRA establishes mandatory cybersecurity requirements for hardware and software on the EU market. Initially adopted as Regulation (EU) 2024/2847, it was introduced on December 10th 2024, to address insecure product design and inconsistent security updates. The CRA also helps customers and businesses facing challenges in identifying secure digital products.
What is the CRA?
This act makes cybersecurity a key part of product development instead of an afterthought. Manufacturers must account for security during a product’s lifecycle. This includes planning, design, development, maintenance, and vulnerability handling. The law also gives users clearer information regarding a product’s security features and how to use it safely.
Even though it took effect on December 10, 2024, the obligations are being phased in. Mandatory reporting for exploited vulnerabilities and severe security incidents started on September 11, 2026. From December 11, 2027, the main requirements will be applied.
Covered Products and Businesses
The CRA applies to all sorts of products, such as devices, components, and software. (Image Credit: geralt/pixabay)
All software and hardware products on the EU market are covered by the CRA when their intended or foreseeable use involves directly or indirectly connecting to an additional device or network. This includes final products like smartphones, smart home devices and network equipment, chips, operating systems, and other separately marketed components.
Under the CRA, manufacturers bear the primary responsibility for compliance. In this case, they must be sure that their products meet the essential cybersecurity requirements before placing them on the market. Importers and distributors also have obligations. While importers verify that products meet compliance requirements, distributors check that products have CE marking and include required user information. A business marketing a product under its own name or substantially modifying it may be treated as the manufacturer.
It’s worth noting that not every digital product meets the CRA’s scope. Products governed by other EU legislation with similar cybersecurity requirements are excluded. Medical devices, for example, are not part of it. Free and open-source software that isn’t supplied as part of a commercial activity is outside the Act’s scope. Certain open-source software stewards have limited obligations.
CRA’s Main Requirements
Manufacturers are required to fix vulnerabilities throughout a product’s support period. (Image Credit: pixelcreatures/pixabay)
The CRA’s main focus is “secure by design.” Instead of treating security as an optional feature after development, manufacturers must assess cybersecurity risks throughout the lifecycle. They then use that assessment to inform decisions across planning, design, development, production, delivery, and maintenance. Each safeguard depends on the risk associated with each product.
Based on their risks, products need to be designed, developed, and produced to ensure they have the right level of cybersecurity. These must launch on the market without exploitable vulnerabilities while using secure default settings. For instance, manufacturers shouldn’t use easy-to-guess default passwords. Appropriate access controls and cryptographic protections should also be provided.
Manufacturers must establish processes to identify, document, and address vulnerabilities during the support period of the product. This includes security testing, remediation, and deploying security updates. If a 3rd party integrated component has a vulnerability, manufacturers are required to address it and inform the component’s manufacturer or maintainer.
In addition, manufacturers need to figure out how long vulnerability handling and security support will be provided. This may cover how long the product is expected to be in use, with considerations for its purpose and other factors. This must be at least five years, and if a product will be used for less time, the support period can match the expected lifespan. According to the CRA, all security updates must be available for free.
Before a product with digital elements lands on the market, manufacturers must prepare technical documentation to show how it complies with the CRA. The documentation describes the product, its design and development, cybersecurity risks, measures taken to address them, test results, and the manufacturer’s vulnerability-handling processes. It must be available to market surveillance authorities upon request.
For most products, manufacturers can use an internal control procedure to show they meet compliance. Requirements are stricter for important or critical products from a cybersecurity perspective. A notified body provides an independent third-party assessment, depending on the product category and standards. Critical products require this assessment or an EU cybersecurity certification scheme.
After a Product Lands on the Market
(Image Credit: geralt/pixabay)
It’s imperative for companies to understand when a post-market change shifts into a substantial modification. According to the guidance, software updates, repairs, and spare parts can raise this question. If a modification becomes substantial, it may produce further compliance obligations.
After completing the mandatory conformity assessment, manufacturers are obligated to draw up an EU declaration of conformity and affix the CE marking to the product. The CE marking is an indicator that the product has met the EU requirements. This is only part of the compliance process and doesn’t mean the product won’t be compromised.
When Do the Requirements Apply?
The CRA is being gradually implemented. That means companies must differentiate between the reporting rules in place and the broader cybersecurity requirements being applied in the future.
Important implementation dates:
- December 10th, 2024: The CRA went into effect
- September 11th, 2026: Manufacturers and open-source software stewards (where applicable) mandatory reporting began
- December 11th, 2027: The CRA’s main product-security requirements will become applicable
Products with digital elements that were available on the EU market before December 2027 are also required to be reported. This means companies can’t assume that products on the market are exempt from the vulnerability and incident reporting.
The CRA Reporting Process
Since September 11th, manufacturers are required to report exploited vulnerabilities and severe incidents that affect the security of products with digital elements. The CRA has set certain deadlines to notify the national Computer Security Incident Response Team (CSIRT) and the European Union Agency for Cybersecurity (ENISA)
There are three stages in the reporting process. Within the first 24 hours, an early warning must be submitted after an exploited vulnerability or severe incident is known. Within 72 hours, a fuller notification is submitted. It includes general information and an initial assessment. Lastly, a final report for an exploited vulnerability is submitted no later than 14 days after a corrective or mitigating measure is available. A severe incident must be submitted within one month of the 72-hour notification.
Each report is filed via the CRA Single Reporting Platform that ENISA operates. Manufacturers use this platform to report once, and the information is made available to the CSIRT and ENISA.
How Do Companies Prepare?
Rather than wait for the December 2027 deadline, companies are advised to start preparing for the Cyber Resilience Act. As a first step, they would review the hardware and software they sell in the EU and determine which ones fall within the regulation’s scope.
Afterward, businesses can evaluate their cybersecurity practices against the CRA’s requirements. This involves reviewing secure development processes, documenting product risks, establishing vulnerability-planning procedures, and planning how security updates will be deployed throughout each product’s support period. It’s also advised that companies review technical documentation and determine which conformity assessment procedures apply to their products.
In addition, manufacturers are required to prepare for mandatory reporting that went into effect in September 2026. They can create internal procedures to help identify reportable vulnerabilities and severe incidents. Doing so allows them to assign responsibilities for notifications while meeting essential deadlines.
Smaller businesses can have some assistance to navigate these preparations. In July 2026, the European Commission posted practical guidance that explains how the CRA applies. This includes examples on product support periods, risk assessments, and reporting. ENISA published the SME Cyber Resilience Maturity Assessment Model for small and medium-sized businesses to identify weaknesses and prioritize improvements.
Generally, the CRA ensures that cybersecurity is implemented in digital products on the EU market. Mandatory reporting is already underway, and the deadline for the main requirements is December 2027. Companies assessing products, processes, and documentation can make preparations to meet the requirements and avoid last-minute compliance work.