The EU Cyber Resilience Act is the first European law to set mandatory cybersecurity requirements for virtually every product with digital elements sold in the EU, from smart sensors and routers to industrial controllers and standalone software. Adopted as Regulation (EU) 2024/2847, it entered into force in December 2024 and its obligations are now arriving in stages.
The reasoning behind it is blunt. The European Commission, in the impact work behind the regulation, put the global annual cost of cybercrime at an estimated €5.5 trillion by 2021, and connected products with weak security are one of the main ways attackers get in. Until now, most hardware and software carried no baseline security requirement at all to reach the EU market.
That changes with the CRA. Security becomes a condition of market access, the same way safety already is, and it is enforced through the CE mark your product may already carry.
In this article, we’ll cover who the EU Cyber Resilience Act applies to, what it requires, the deadlines that matter and how to prepare without stopping your roadmap.
Who the EU Cyber Resilience Act applies to
The scope is deliberately wide. The regulation covers products with digital elements: hardware and software whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network.
In practice, that includes:
- Connected hardware. Routers, smart home devices, wearables, industrial sensors, controllers and machines with network interfaces.
- Standalone software. Operating systems, applications, firmware and software components placed on the EU market, including many B2B products.
- Remote data processing tied to the product. Cloud functions without which the product would not perform its functions fall inside the product’s scope.
The obligations reach the whole supply chain, not only the maker. Manufacturers carry the core duties, but importers and distributors must verify that products they place or make available on the EU market comply. Critically, the CRA applies to any product sold in the EU regardless of where the manufacturer is based. A US or UK software company selling into the EU is in scope just like a German one.
A few categories are carved out because they are covered by their own sector rules: medical devices, in vitro diagnostics, certain motor vehicle systems, civil aviation equipment and marine equipment. Open-source software developed outside a commercial activity is also treated differently, with a lighter regime for open-source stewards.
What the CRA actually requires
The regulation groups its demands into two families: how the product is built, and how it is looked after once it ships.
Security by design and by default
Annex I of the CRA sets essential requirements that products must meet before they are placed on the market. Among the most consequential:
- No known exploitable vulnerabilities. Products must ship without known exploitable vulnerabilities, which makes pre-release penetration testing and vulnerability assessment a practical necessity rather than a nice-to-have.
- Secure default configuration. Products must be secure out of the box, without relying on the user to harden them.
- Protection of data and functions. Confidentiality, integrity and availability protections proportionate to the risks, including encryption of relevant data.
- Attack surface minimisation. Only the interfaces and services the product needs, nothing else exposed.
Vulnerability handling across the product’s life
Manufacturers must run a documented vulnerability handling process for a support period of at least five years (or the expected product lifetime, if shorter). That includes identifying and remediating vulnerabilities, providing security updates, operating a coordinated vulnerability disclosure policy and publishing information about fixed issues.
This is where many product organisations discover the real work: the CRA turns security from a launch checkbox into an operating capability that has to run for years.
Reporting obligations, already in force
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products, starting with an early warning within 24 hours. These duties arrived more than a year before the rest of the regulation and deserve their own preparation. We break down the full mechanics, deadlines, and recipients in our guide to Cyber Resilience Act reporting obligations.
The CRA timeline: the dates that matter
Here is the schedule every product team should have on the wall:
| Date | What applies |
|---|---|
| 10 December 2024 | The CRA entered into force |
| 11 June 2026 | Rules on notified bodies apply, so conformity assessment capacity can be built |
| 11 September 2026 | Reporting obligations for actively exploited vulnerabilities and severe incidents apply |
| 11 December 2027 | The regulation applies in full, including the essential requirements and CE marking obligations |
December 2027 sounds distant. For anything with a hardware cycle, a certification queue or a multi-release backlog, it is not. Products placed on the market from that date must comply, and security by design cannot be retrofitted in the final sprint.
CE marking and conformity: how compliance is proven
The CRA plugs into the EU’s existing product framework: compliant products carry the CE mark, backed by a conformity assessment and technical documentation. How demanding that assessment is depends on the product’s classification.
The classes, in ascending order of scrutiny:
| Product class | Examples | Conformity route |
|---|---|---|
| Default category | Most products with digital elements | Manufacturer self-assessment |
| Important, Class I | Password managers, VPNs, smart home assistants, network interfaces | Harmonised standards, or third-party assessment |
| Important, Class II | Firewalls, hypervisors, tamper-resistant microcontrollers | Third-party conformity assessment |
| Critical | Smart meter gateways, smartcards, secure elements | European cybersecurity certification where mandated |
One distinction worth being precise about: consultancies, including us, prepare you for conformity. We build the security posture, the documentation and the vulnerability handling process, and we test the product. Where the regulation requires third-party involvement, the assessment itself is carried out by a notified body designated under the CRA. Anyone who offers to both prepare and certify you is skipping a separation the law insists on.
What non-compliance costs
The CRA carries teeth comparable to the GDPR. Non-compliance with the essential requirements can draw administrative fines of up to €15 million or 2.5% of global annual turnover, whichever is higher, alongside the more immediate commercial consequence: market surveillance authorities can restrict or withdraw non-compliant products from the EU market entirely.
For most manufacturers, the market access risk outweighs the fine. A product pulled from the EU shelf mid-lifecycle is a revenue event no security budget line ever matched.
How to prepare without stopping the roadmap
The manufacturers handling the CRA well are treating it as programme work spread across releases, not a compliance sprint in 2027. A workable sequence:
- Scope your portfolio. Inventory every product with digital elements sold in the EU, classify each against the CRA categories and note which conformity route applies.
- Gap-assess against Annex I. Compare current security practice against the essential requirements: secure defaults, update mechanisms, data protection, attack surface.
- Stand up vulnerability handling. A disclosure policy, an intake process, remediation workflows, and an update pipeline that can serve the full support period.
- Build the reporting muscle now. The 24-hour clock is already running. Define who detects, who decides, and who submits before you need them, using our reporting obligations guide as the checklist.
- Test before you attest. Independent penetration testing against the product and its update mechanism is the fastest way to find what a self-assessment would miss.
- Assemble the technical documentation as you go. The file that supports the CE mark grows release by release painlessly, and painfully all at once.
Frequently Asked Questions
What is the EU Cyber Resilience Act?
The EU Cyber Resilience Act is Regulation (EU) 2024/2847, the first EU law setting mandatory cybersecurity requirements for products with digital elements. It requires hardware and software sold in the EU to be secure by design, supported with security updates and backed by vulnerability handling and reporting processes, proven through CE marking.
Who must comply with the EU Cyber Resilience Act?
Manufacturers of hardware and software with digital elements sold in the EU carry the main obligations, wherever in the world they are based. Importers and distributors must verify compliance for products they place or make available on the EU market. Sector-regulated products such as medical devices are exempt, and non-commercial open-source development has a lighter regime.
When does the Cyber Resilience Act apply?
The regulation entered into force on 10 December 2024. Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026, and the regulation applies in full, including the essential requirements and CE marking, from 11 December 2027.
What are the penalties for non-compliance with the CRA?
Administrative fines can reach €15 million or 2.5% of global annual turnover, whichever is higher, for breaches of the essential requirements. Market surveillance authorities can also restrict, recall or withdraw non-compliant products from the EU market, which is often the larger commercial risk.
Does the Cyber Resilience Act require third-party certification?
It depends on the product’s classification. Most products in the default category can self-assess against the requirements. Important Class I products can use harmonised standards or third-party assessment, Important Class II products require third-party conformity assessment, and critical products may require European cybersecurity certification. Third-party assessments are performed by notified bodies designated under the regulation.
Prepare for the Cyber Resilience Act with CyberGlobal
The CRA rewards the manufacturers who start early and spread the work. We help product companies scope their portfolio against the regulation, close the gaps in design and process, test what they build and assemble the documentation behind the CE mark, with local teams across Europe and a global bench behind them. Where a notified body is required, we get you ready for that assessment and stand beside you through it.
Let’s figure out where your products stand.
