EU Cyber Resilience Act (CRA)
Horizontal cybersecurity requirements for hardware and software with digital elements sold in the EU: secure-by-design, vulnerability handling, SBOM, CE marking. Reporting obligations apply from 11 September 2026; full application and conformity assessment from 11 December 2027.
| Jurisdiction | European Union |
|---|---|
| Category | Cybersecurity |
| Status | Phased |
| Effective date | |
| Latest development |
Analysis
The EU Cyber Resilience Act (CRA) is an EU regulation (Regulation (EU) 2024/2847) that introduces mandatory cybersecurity requirements for nearly all products with digital elements (PDEs) placed on the EU market, with most obligations applying from 11 December 2027 and certain reporting duties from 11 September 2026.Cyber Resilience Act – EU Commission Regulation (EU) 2024/2847 – EUR-Lex EU CRA FAQ – Wind River
Key Requirements
According to the CRA, manufacturers, importers, and distributors of products with digital elements must comply with a broad set of cybersecurity obligations throughout the product lifecycle.Cyber Resilience Act – EU Commission White & Case CRA Overview EU CRA FAQs – Wind River
- Scope: Products with Digital Elements (PDEs)
- The CRA applies to hardware and software “products with digital elements”, including remote data processing, placed on the EU market, regardless of where they are manufactured.EU CRA FAQs – Wind River OpenSSF CRA Policy Overview
- Certain sectors (e.g., medical devices, automotive) are excluded where specialized EU product rules already apply.OpenSSF CRA Policy Overview EU CRA FAQs – Wind River
- Security‑by‑Design and by Default
- Manufacturers must ensure products are secure by design and by default across planning, design, development, production, delivery, and maintenance phases.Cyber Resilience Act – EU Commission White & Case CRA Overview
- Products must meet essential cybersecurity requirements, including protection against known vulnerabilities, secure configuration defaults, and robust authentication and access control.Regulation (EU) 2024/2847 – EUR-Lex Cycode CRA Guide
- Lifecycle‑Wide Vulnerability Management
- Manufacturers must assess cybersecurity risks and take mitigation measures throughout the product lifecycle and support period.White & Case CRA Overview Cyber Resilience Act – EU Commission
- They must address vulnerabilities discovered during the support period and refrain from placing products on the market with known vulnerabilities.White & Case CRA Overview Regulation (EU) 2024/2847 – EUR-Lex
- Automatic Security Updates and Support Transparency
- Where products are reasonably expected to receive updates, security updates must be automatic by default, while allowing users to opt out.Cyber Resilience Act – Wikipedia Cycode CRA Guide
- Manufacturers must clearly communicate the support period and update policies to users.EU CRA FAQs – Wind River Cycode CRA Guide
- Incident and Vulnerability Reporting Obligations
- From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security via a Single Reporting Platform (SRP).CRA Reporting Obligations – EU Commission Cyber Resilience Act – EU Commission
- An early warning must be submitted within 24 hours of becoming aware, followed by fuller notifications within 72 hours, and a final report within defined timelines (14 days or one month depending on case).CRA Reporting Obligations – EU Commission White & Case CRA Overview
- Conformity Assessment, CE Marking, and Documentation
- Manufacturers must perform a conformity assessment, compile technical documentation, and affix the CE marking to products demonstrating compliance with CRA requirements.White & Case CRA Overview Regulation (EU) 2024/2847 – EUR-Lex
- Member States must designate conformity assessment bodies and notify them to the Commission by mid‑2026.EU CRA FAQs – Wind River Cisco EU CRA Solution Brief
- Transparency to Users and Security Information
- Products must be accompanied by instructions and security information enabling secure configuration and use.White & Case CRA Overview Regulation (EU) 2024/2847 – EUR-Lex
- Consumers must be properly informed about the cybersecurity characteristics of products they buy.EU CRA FAQs – Wind River Cyber Resilience Act – EU Commission
- Roles and Responsibilities (Manufacturers, Importers, Distributors)
- The CRA defines distinct obligations for manufacturers, importers, and distributors, all of whom must ensure only compliant products are placed or made available on the market.Regulation (EU) 2024/2847 – EUR-Lex EU CRA FAQs – Wind River
- Non‑EU companies whose products are sold in the EU must also comply to retain market access.ArmorCode CRA Requirements Guide OpenSSF CRA Policy Overview
- Penalties for Non‑Compliance
- The CRA provides for administrative fines up to the greater of €15 million or 2.5% of global annual turnover for the previous financial year for serious non‑compliance.White & Case CRA Overview Cyber Resilience Act – Wikipedia
Compliance Challenges
Organizations face both technical and organizational challenges in achieving CRA compliance, particularly given its broad scope and lifecycle‑wide obligations.ArmorCode CRA Requirements Guide Cycode CRA Guide
- Complex Scope and Product Classification
- Determining whether a product is a PDE and mapping which modules, firmware, and remote data processing fall under CRA can be complex, especially for IoT and embedded systems.EU CRA FAQs – Wind River Cisco EU CRA Solution Brief
- Industry analyses note that multi‑component systems and hybrid cloud‑edge solutions create ambiguity in scoping responsibilities.OpenSSF CRA Policy Overview Cycode CRA Guide
- Legacy Products and Technical Debt
- Many manufacturers have large portfolios of legacy devices and software that were not designed with security‑by‑design, making retrofit or retirement decisions difficult.ArmorCode CRA Requirements Guide Cycode CRA Guide
- Industry FAQs highlight that manufacturers remain responsible for cybersecurity throughout the lifecycle, which is especially challenging for long‑lived industrial or embedded products.EU CRA FAQs – Wind River Cisco EU CRA Solution Brief
- Continuous Vulnerability Management and SBOMs
- CRA compliance elevates continuous vulnerability management and often requires a Software Bill of Materials (SBOM) for transparency, which many organizations do not yet systematically produce.Cycode CRA Guide ArmorCode CRA Requirements Guide
- OpenSSF notes significant burden on vendors to track vulnerabilities in open‑source components used in PDEs and to coordinate disclosure.OpenSSF CRA Policy Overview Cycode CRA Guide
- Incident Reporting and Operational Readiness
- The CRA’s strict timelines (24‑hour early warning, 72‑hour detailed notification) require mature detection and response processes, which many organizations still lack.CRA Reporting Obligations – EU Commission White & Case CRA Overview
- Cisco’s CRA brief stresses the need for centralized monitoring and reporting workflows to consistently meet CRA requirements across global product lines.Cisco EU CRA Solution Brief ArmorCode CRA Requirements Guide
- Organizational Alignment and Cost
- Legal analyses note that aligning engineering, product management, compliance, and security operations around CRA requirements is a significant organizational change.White & Case CRA Overview Cycode CRA Guide
- OpenSSF and industry guides highlight concerns about compliance costs, particularly for SMEs and open‑source maintainers whose work is integrated into commercial PDEs.OpenSSF CRA Policy Overview ArmorCode CRA Requirements Guide
- Real‑World Examples & Case‑Style Analyses
- OpenSSF provides scenarios showing how CRA could affect open‑source software projects whose code is embedded in commercial products, creating new obligations for vendors and indirect pressure on maintainers.OpenSSF CRA Policy Overview
- Vendor guides from companies like Cisco and Wind River describe impacts on complex industrial, networking, and embedded systems, acting as case‑style analyses of CRA implementation challenges.Cisco EU CRA Solution Brief EU CRA FAQs – Wind River
Implementation Best Practices
Organizations can mitigate CRA risk by adopting structured, security‑by‑design programs, aligning with recognized cybersecurity frameworks, and building specific CRA processes.ArmorCode CRA Requirements Guide Cycode CRA Guide
- Map CRA Requirements to Product Portfolio and Risk
- Perform a CRA readiness assessment to identify in‑scope products, critical PDEs, and applicable essential requirements.White & Case CRA Overview ArmorCode CRA Requirements Guide
- Use internal product catalogs and architecture diagrams to map dependencies, remote data processing, and third‑party components.Cycode CRA Guide Cisco EU CRA Solution Brief
- Embed Security‑by‑Design in SDLC and Hardware Development
- Integrate threat modeling, secure coding, and secure configuration baselines into the software development lifecycle (SDLC) and hardware design processes.Cycode CRA Guide ArmorCode CRA Requirements Guide
- Legal and industry guides recommend aligning CRA implementation with existing frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, and secure development lifecycle models to reduce duplication.White & Case CRA Overview Cisco EU CRA Solution Brief
- Establish Robust Vulnerability Management and SBOM Practices
- Implement continuous vulnerability scanning, coordinated vulnerability disclosure (CVD), and clear patching SLAs for all PDEs.Cycode CRA Guide ArmorCode CRA Requirements Guide
- Use tools that generate and maintain SBOMs to track third‑party and open‑source components in products, as recommended in CRA compliance guides.Cycode CRA Guide OpenSSF CRA Policy Overview
- Design Incident Reporting and SRP Integration Processes
- Set up internal processes to detect actively exploited vulnerabilities and severe incidents, classify them according to CRA criteria, and prepare structured reports within the required timeframes.CRA Reporting Obligations – EU Commission White & Case CRA Overview
- Industry solution briefs recommend centralizing logging, security monitoring, and incident response to facilitate CRA reporting via the Single Reporting Platform.CRA Reporting Obligations – EU Commission Cisco EU CRA Solution Brief
- Align with Implementation Guides and Frameworks
- Use CRA‑specific implementation guides from security vendors as practical roadmaps for mapping requirements to technical controls.ArmorCode CRA Requirements Guide Cycode CRA Guide
- Leverage broader frameworks (e.g., secure‑by‑design best practices under EU digital policies) to support compliance.Cyber Resilience Act – EU Commission OpenSSF CRA Policy Overview
- Tools and Resources (Examples)
- CRA‑focused solution briefs from large vendors (e.g., Cisco) describe security platforms and architectures designed to support CRA obligations such as vulnerability management and secure updates.[Cisco EU CRA Solution Brief](https://www.cisco.com/c/en/us/products/collateral/security/eu-cra
Recent developments
- — CRA vulnerability and incident reporting obligations apply: manufacturers must file 24-hour early warnings and 72-hour notifications through the ENISA Single Reporting Platform. (source)
- — European Commission publishes an implementation fact page detailing the phased application of the Cyber Resilience Act (CRA), confirming that Chapter IV on notification of conformity assessment bodies applies from 2026-06-11 and incident/vulnerability reporting from 2026-09-11, ahead of full application on 2027-12-11.[1][8] (source)
- — Commission reiterates the CRA implementation timeline and begins focusing outreach on manufacturers of “products with digital elements”, stressing upcoming 2026 reporting obligations and 2027 CE-marking and essential cybersecurity requirements for all in‑scope hardware and software.[6][8] (source)
- — Key CRA *Chapter IV* provisions on notification of conformity assessment bodies start to apply, enabling designation of notified bodies that will conduct third‑party assessments for higher‑risk products in advance of the 2027 full application date.[8] (source)
- — Independent “state of play” tracker highlights that the CRA is now in force and in the implementation phase, warning companies that the clock is ticking toward 2026 reporting and 2027 full compliance deadlines and urging immediate gap assessments and roadmap planning.[7] (source)
- — Law firm analysis emphasizes enforcement risks under the CRA, detailing that from 2026-09-11 manufacturers must notify ENISA and national authorities of actively exploited vulnerabilities and severe incidents, and that maximum penalties can reach €15 million or 2.5% of global turnover.[4] (source)
- — Honeywell issues supplier guidance on the CRA, underlining that vulnerability and incident reporting obligations start on 2026-09-11 and that from 2027-12-11 only products with CE marking demonstrating CRA conformity can be placed on the EU market, signaling significant supply‑chain impacts.[3] (source)
- — Security vendor commentary outlines practical steps companies must take before 2027, including SBOMs, threat models, risk assessments and 10‑year documentation retention, noting that non‑compliance can lead to fines up to €15 million or 2.5% of global revenue and driving major investment in secure development practices.[5] (source)
- — Open Source Security Foundation updates its CRA guidance, highlighting that the law entered into force in 2024, that certain obligations become mandatory on 2026-09-11 and full application is on 2027-12-11, and reiterating industry concerns and clarifications around treatment of open source components.[2] (source)
- — Commission communication on CRA policy context stresses its horizontal scope over most products with digital elements (excluding sectors with their own regimes) and its goal to address inadequate cybersecurity and lack of timely security updates, signaling alignment with broader EU digital resilience initiatives.[6] (source)
- — Updated CRA summary clarifies detailed obligations for economic operators across the product lifecycle, including vulnerability handling, incident reporting timelines (initial notification, intermediate report, and final report within 14 days after mitigation) and confirms that EU type‑examination certificates remain valid until 2028-06-11, shaping conformity strategies for technology manufacturers.[8] (source)
Related regulations
- Artificial Intelligence Liability Directive — European Union, Active
- EU AI Act - Annex III High-Risk System Requirements (2 Dec 2027) — European Union, Upcoming, effective 2027-12-02
- EU Data Act — European Union, Phased, effective 2025-09-12
- EU AI Act - GPAI Model Obligations (2 Aug 2025) and Enforcement (2 Aug 2026) — European Union, Active, effective 2025-08-02
- EU Digital Omnibus on AI (Regulation (EU) 2026/1744) — European Union, Active, effective 2026-07-27
- EU AI Act - Synthetic Media Transparency and New Prohibitions (2 Dec 2026) — European Union, Upcoming, effective 2026-12-02
- EU AI Act - Annex I High-Risk Systems (2 Aug 2028) — European Union, Upcoming, effective 2028-08-02
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
Put it into practice
- Generate the policy: NIS2 policy generator (generatepolicy.com)
- Buy the policy pack: Cyber Resilience Act CRA Policy (cyberpolicy.shop)
- Build it yourself: EU Cyber Resilience Act Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates