Cyber Resilience Act: What the EU CRA Requires and When

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets mandatory cybersecurity rules for hardware and software "products with digital elements" sold in the EU, wherever they are made. It entered into force on December 10, 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since September 11, 2026, and the rest of the regulation applies from December 11, 2027: the essential requirements in Annex I, vulnerability handling with a software bill of materials (SBOM), a support period that is normally at least five years, technical documentation, conformity assessment, and CE marking. Most products can be self-assessed. Products whose core function matches a category in Annex III or Annex IV may need a notified body or a European cybersecurity certificate. The top fine is EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher.

What products does the Cyber Resilience Act cover?

Article 2(1) applies the CRA to products with digital elements made available on the EU market whose intended purpose or reasonably foreseeable use includes a direct or indirect, logical or physical data connection to a device or network. Article 3(1) defines such a product as a software or hardware product and its remote data processing solutions, including components placed on the market separately.

Remote data processing is in scope when the manufacturer designs the software for it, or has it developed under its responsibility, and the product could not perform one of its functions without it (Article 3(2)). Recital 11's example is a mobile application that depends on a service the manufacturer provides. Recital 12 excludes cloud services designed and developed outside a manufacturer's responsibility, and it notes that the NIS2 Directive covers cloud computing services, including software as a service, offered by medium-sized and larger providers. Standalone SaaS is therefore outside the CRA and can be a NIS2 question, while a connected device's backend is a CRA question.

Article 2 excludes products covered by the EU medical device, in vitro diagnostic, and vehicle type-approval regulations, products certified under the civil aviation regulation, and marine equipment. It also excludes spare parts that replace identical components and are built to the same specifications (Article 2(6)), and products developed or modified exclusively for national security or defense (Article 2(7)).

Open-source software is in scope only when it is made available in the course of a commercial activity, a condition Article 3(22) builds into "making available on the market." Recital 18 says that providing open-source products their manufacturers do not monetize is not a commercial activity. A company that ships an open-source library inside its own commercial product is that product's manufacturer and must exercise due diligence on the components it integrates (Article 13(5)). Open-source software stewards, legal persons that systematically support open-source products intended for commercial activities (Article 3(14)), get a lighter regime under Article 24.

Which CRA product class applies, and which conformity route?

Core functionality decides the class, and the class decides who assesses conformity. Article 7 makes a product "important" when its core functionality matches a category in Annex III, split into class I and class II, and Annex IV lists "critical" products. Implementing Regulation (EU) 2025/2392, adopted on November 28, 2025, describes each category technically. Article 32 sets the routes.

Integrating a listed component does not, by itself, move the host product into that class (Article 7(1)). The recitals of the implementing regulation note that a smartphone that includes an operating system or a password manager generally does not meet those categories. Article 32(5) lets open-source products in Annex III categories use the default procedures, provided the technical documentation is public.

Chapter IV, which governs the notification of conformity assessment bodies, has applied only since June 11, 2026, so manufacturers of class II and critical products, and of class I products built without full standards, should confirm which bodies have been notified for their category before they commit to a launch date.

When do CRA obligations apply?

Article 71 staggers the dates that follow entry into force. Chapter IV, the rules for notifying conformity assessment bodies (Articles 35 to 51), has applied since June 11, 2026. Article 14 reporting has applied since September 11, 2026. Everything else applies from December 11, 2027.

Under Article 69(2), a product placed on the market before December 11, 2027 falls under the CRA only if it is substantially modified afterward, meaning a change that affects compliance with Annex I, Part I or modifies the intended purpose that was assessed (Article 3(30)). Placing on the market applies unit by unit, though: recital 38 says the requirements apply "to each individual product with digital elements when placed on the market," so units of an older model placed on the market from December 11, 2027 must comply. Reporting is the exception, because Article 69(3) applies Article 14 to every in-scope product, whenever it was placed on the market.

Who has obligations under the CRA?

The manufacturer, the person who develops or manufactures a product with digital elements, or has one made, and markets it under its own name or trademark (Article 3(13)), carries most of the regulation. Article 13 runs to 25 paragraphs, covering a cybersecurity risk assessment kept in the technical documentation, due diligence on third-party components, vulnerability handling for the support period, conformity assessment, a single point of contact for vulnerability reports (Article 13(17)), and retention of the technical documentation and EU declaration of conformity for 10 years or the support period, whichever is longer (Article 13(13)).

An importer, an EU-established person that places on the market a product bearing a non-EU person's name or trademark (Article 3(16)), must check before placing it that the manufacturer completed the conformity assessment, drew up the technical documentation, affixed the CE marking, and supplied the declaration and user information (Article 19). Distributors verify the CE marking and those documents before selling (Article 20). Both must tell the manufacturer about vulnerabilities they learn of without undue delay. Appointing an authorised representative is optional (Article 18).

Roles can change. Under Article 21, an importer or distributor becomes the manufacturer when it places a product on the market under its own name or trademark or substantially modifies one already on the market, and Article 22 does the same for anyone else who substantially modifies a product and makes it available. For a US company, the CRA follows the product into the EU: the US manufacturer answers for the design, the documentation, and the reports, and its EU importer checks that work before the product ships.

What are the CRA's essential cybersecurity requirements?

Security properties of the product (Annex I, Part I)

Annex I, Part I requires an appropriate level of cybersecurity based on the risks. Applied through the Article 13(2) risk assessment, its 13 requirements cover release without known exploitable vulnerabilities; a secure-by-default configuration with a reset; security updates, automatic by default where applicable, with an opt-out; protection from unauthorized access; encryption for confidentiality; integrity of data, commands, programs, and configuration; data minimization; availability of essential functions, including against denial-of-service attacks; limits on harm to other devices; reduced attack surfaces; exploitation mitigation; logging of relevant internal activity, with a user opt-out; and secure deletion of data and settings.

Vulnerability handling (Annex I, Part II)

Part II governs the manufacturer's processes. Point 1 requires an SBOM "in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products." The other points require fixing vulnerabilities without delay, with security updates separate from feature updates where technically feasible; regular security testing; public disclosure of fixed vulnerabilities; a coordinated vulnerability disclosure policy and a reporting contact; secure update distribution; and free security updates with advisory messages. Our guide to SBOM requirements compares the CRA's SBOM duty with US federal and FDA rules.

Support period and security updates

Article 13(8) sets the support period at no less than five years, unless the product is expected to be in use for less, in which case it matches the expected use time. The manufacturer sets it from the expected time in use and reasonable user expectations, and records the basis in the technical documentation. Each security update must stay available for at least 10 years after release or for the rest of the support period, whichever is longer (Article 13(9)), and the end date, at least the month and year, must be clear at purchase (Article 13(19)).

What does CRA conformity assessment require?

Every route starts with technical documentation drawn up before the product is placed on the market (Article 31 and Annex VII). It covers the product description and the software versions that affect compliance; design, production, and vulnerability handling processes, including the system architecture, the SBOM, the disclosure policy, and the update mechanism; the risk assessment; the basis for the support period; the standards or schemes applied; test reports; and the EU declaration of conformity.

Under module A the manufacturer assesses its own product. Under module B a notified body examines the technical design and vulnerability handling processes and issues an EU-type examination certificate, with module C covering production against that type, and under module H a notified body approves and audits the full quality system (Annex VIII). The manufacturer then signs the EU declaration of conformity (Article 28) and affixes the CE marking (Article 30), which software can carry on the declaration or the accompanying website. Notified bodies appear in the Commission's NANDO database once notified, and Article 39 requires each to be independent of the products it assesses and bars activities that could conflict with that independence, consultancy services in particular.

Harmonized standards and the presumption of conformity

Under Article 27, a product built to harmonized standards whose references are published in the Official Journal is presumed to meet the requirements they cover. On August 13, 2026, ETSI opened the approval process for 17 product-specific CRA standards in its EN 304 series, covering categories such as password managers, anti-virus software, and connected toys, with the approval procedure closing between mid-September and mid-November 2026, depending on the product category. As of October 20, 2026, no CRA standard had been cited in the Official Journal, so no manufacturer could yet rely on that presumption, which matters most for class I products. Annex VII, point 5 then requires the documentation to describe the solutions adopted for each requirement. For industrial automation products, our IEC 62443 guide covers how that series relates to the CRA. The Commission's guidance on applying the CRA, published July 27, 2026, covers scope, substantial modification, support periods, and reporting.

What must manufacturers report under the CRA?

Since September 11, 2026, Article 14 has required a manufacturer that becomes aware of an actively exploited vulnerability in its product, or a severe incident affecting the product's security, to notify the CSIRT designated as coordinator and ENISA at the same time through the single reporting platform, which ENISA launched that day. The clocks are an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days after a fix or mitigation is available for a vulnerability, or within one month after the notification for an incident. The manufacturer must also inform impacted users (Article 14(8)). Our guide to CRA reporting obligations covers the definitions that start the clock and the process behind it.

What are the penalties for CRA non-compliance?

Article 64 caps fines at the higher of a fixed amount or a share of worldwide annual turnover. Breaches of Annex I and of Articles 13 and 14 carry up to EUR 15 million or 2.5 percent. Breaches of other operator obligations, including importer and distributor duties, the declaration of conformity, CE marking, technical documentation, and conformity assessment, carry up to EUR 10 million or 2 percent. Incorrect, incomplete, or misleading information given to notified bodies or market surveillance authorities carries up to EUR 5 million or 1 percent. Article 64(10) spares microenterprises and small enterprises from fines for missing the 24-hour early warning and exempts open-source software stewards. Member States set the penalty rules, and Article 67 adds the CRA to the Representative Actions Directive, so qualified entities such as consumer organizations can bring representative actions.

How does the CRA relate to NIS2, the AI Act, the RED, GDPR, and ESPR?

NIS2 regulates essential and important entities and their incident reporting under its Article 23; the CRA regulates products, and one company can carry both duties. Under Article 12 of the CRA, a high-risk AI system that meets Annex I and shows it in its EU declaration of conformity is deemed to meet the AI Act's Article 15 cybersecurity requirements, without prejudice to that article's accuracy and robustness requirements.

Under the Radio Equipment Directive, Delegated Regulation (EU) 2022/30 has applied cybersecurity requirements to certain radio equipment since August 1, 2025. Recital 30 of the CRA anticipated that the Commission would repeal or amend that act for products the CRA covers, and Delegated Regulation (EU) 2026/339, published April 29, 2026, repeals it with effect from December 11, 2027. Recital 32 states that the CRA is without prejudice to the GDPR. ESPR is a separate law: when a connected product also needs a digital product passport, ESPR governs the passport and the CRA governs the product, as our article on digital product passport security explains.

How should a manufacturer prepare for the CRA?

Reporting already applies. The rest can run product line by product line, in this order.

1. Inventory every product and version sold into the EU, its sales channels, and your role for each: manufacturer, importer, or distributor.
2. Classify each product against the Article 2 scope test, the exclusions, and the Annex III and IV technical descriptions.
3. Confirm the Article 14 process works today: intake, triage, the coordinating CSIRT, platform access, and a named owner for the 24-hour clock.
4. Run the Article 13(2) risk assessment and a gap assessment against both parts of Annex I.
5. Generate SBOMs in the build pipeline and record due diligence on third-party and open-source components.
6. Set and publish support periods, the disclosure policy, and the security update policy.
7. Assemble the Annex VII documentation, test the product and its update mechanism, choose the conformity route, and book notified body time early where you need one.

How BD Emerson helps with CRA readiness

BD Emerson's Cyber Resilience Act compliance team runs that sequence with product, engineering, and security staff: product scoping and classification, gap assessments against Annex I, vulnerability handling and PSIRT process design, Article 14 reporting readiness, SBOM programs, technical documentation support, and product security testing through our penetration testing practice. BD Emerson is not a notified body, and we do not perform third-party conformity assessment or issue certificates. We prepare the documentation and evidence, and a notified body you engage assesses them, so the firm that prepares you has no stake in passing you. How the regulation applies to a specific product or contract is a question for your counsel, and we work alongside them. For connected products that also need digital product passports, we run the CRA work inside our ESPR compliance program so one inventory and one vulnerability process serve both.

Frequently asked questions

What is a product with digital elements under the CRA? Article 3(1) of the Cyber Resilience Act defines a product with digital elements as a software or hardware product and its remote data processing solutions, including components placed on the market separately. The CRA covers it when its intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network, which takes in connected devices, installable software, and the backend a device needs in order to work.

What is the difference between the CRA and NIS2? The CRA regulates products: it sets security requirements for hardware and software sold in the EU and puts the duties on manufacturers, importers, and distributors. NIS2, Directive (EU) 2022/2555, regulates organizations: essential and important entities must manage cybersecurity risk and report significant incidents under its Article 23. Recital 12 of the CRA excludes standalone cloud services, including SaaS, and notes that NIS2 covers cloud computing providers of medium size and larger. One software company can be subject to both.

Does the Cyber Resilience Act apply to open-source software? Open-source software falls under the CRA only when it is made available in the course of a commercial activity, and recital 18 says that providing open-source products their manufacturers do not monetize is not one. A company that builds open-source components into a commercial product owns that product's compliance and must exercise due diligence on them. Open-source software stewards have lighter duties under Article 24 and are exempt from fines.

Does the CRA apply to products already on the market? Under Article 69(2), a product placed on the market before December 11, 2027 falls under the CRA only if it is substantially modified from that date. Each unit counts separately, so units of an older model placed on the market from that date must comply. Article 69(3) applies the Article 14 reporting duty, in force since September 11, 2026, to every in-scope product, whenever it was placed on the market.

What is the minimum support period under the CRA? Article 13(8) requires a support period of at least five years, unless the product is expected to be in use for less, in which case the support period matches the expected use time. Each security update must stay available for at least 10 years after release or for the rest of the support period, whichever is longer, and the end date of support must be shown at the time of purchase.

Does software need a CE marking under the CRA? From December 11, 2027, software placed on the EU market as a product with digital elements needs the CE marking once its conformity assessment is complete. Under Article 30, the manufacturer can affix it to the EU declaration of conformity or to the website that accompanies the software, provided that section is easily and directly accessible to consumers.

If you sell connected products or software into the EU and need to know which class each one falls into, our Cyber Resilience Act compliance team can classify the portfolio, run the Annex I gap assessment, and stand up the reporting process with your product security staff.