EU Cyber Resilience Act: What Software and Hardware Makers Must Do

Short answer: The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity rules for hardware and software sold in the EU. Manufacturers must build products securely, handle vulnerabilities through a support period and carry CE marking. Reporting duties applied from 11 September 2026, and most other obligations apply from 11 December 2027.

Related guides: EU Cyber Resilience Act SBOM requirements, EU cybersecurity regulations for SaaS, vulnerability management

Key takeaways

• The CRA is a product law. It attaches to what you place on the EU market, not to your company's sector or size.
• As of November 2026, reporting of actively exploited vulnerabilities and severe incidents is already live, including for products sold before the full rules begin.
• Pure SaaS is generally handled under NIS 2, but remote data processing that a product needs in order to work falls under the CRA.
• Most products can use self-assessment. Important and critical products face tighter routes.
• Treat 11 December 2027 as the date your secure development, documentation and support commitments must be provable.

What is the EU Cyber Resilience Act?

The Cyber Resilience Act is an EU regulation that makes cybersecurity a condition for selling products with digital elements in the single market. It entered into force on 10 December 2024 and works much like other EU product safety law: meet the essential requirements, prove it, and mark the product.

Before the CRA, security expectations for connected products depended on the product type or the customer contract. The regulation sets one baseline across the EU, covering how a product is designed and how its vulnerabilities are handled after release. The Commission's summary of the legal text is a useful plain-language companion to the full regulation on EUR-Lex.

Responsibility is spread across the supply chain:

Role	Core duty
Manufacturer	Meets the essential requirements, assesses conformity, handles vulnerabilities, reports incidents
Authorised representative	Performs delegated manufacturer tasks under a written mandate
Importer	Checks that non-EU products comply before placing them on the market
Distributor	Verifies CE marking and that earlier parties met their duties
Open-source software steward	Keeps a cybersecurity policy and cooperates with authorities, with lighter duties than a manufacturer

Does the Cyber Resilience Act apply to your product?

The CRA applies if you make a hardware or software product available on the EU market in a commercial activity and its intended or reasonably foreseeable use includes a data connection to a device or network. That wording is broad, and it reaches desktop and mobile software, firmware, connected devices and components sold separately.

Work through these questions in order:

1. Is it supplied commercially in the EU? Products not made available on the market fall outside the rules.
2. Does it have a data connection? Direct or indirect, logical or physical, counts.
3. Is it covered by a sector law the CRA steps aside for? Article 2 of the regulation excludes medical devices under Regulations (EU) 2017/745 and 2017/746, vehicles under Regulation (EU) 2019/2144, certified aviation products, marine equipment, and products developed only for national security or defence.
4. Is it a cloud service? Recital 12 notes that NIS 2 applies to cloud service models such as SaaS. Cloud solutions only count under the CRA when they meet its definition of remote data processing.

Remote data processing is the point many software companies miss. If your installed app or device cannot perform one of its functions without a backend that you design or control, that backend is part of the product for CRA purposes. A browser-only SaaS with no distributed product will usually look to NIS 2 instead, but it is worth confirming this with counsel if you also ship agents, SDKs or desktop clients.

HealthTech teams should check each product separately. Software regulated as a medical device under the EU medical device rules is outside the CRA, while a companion app or wellness product that is not a regulated device may not be.

When do the CRA obligations start?

The CRA phases in over three years, and the first operational deadline has already passed. The Commission's implementation page lists the milestones, and it showed no proposed changes to these dates when we checked in November 2026.

Date	What applies
10 December 2024	Regulation enters into force
11 June 2026	Rules on notifying conformity assessment bodies apply
11 September 2026	Article 14 reporting obligations apply
11 December 2027	Main obligations apply in full

Products placed on the market before 11 December 2027 only come under the wider rules if they are substantially modified after that date. Reporting is the exception, because it also covers products already on the market.

What must manufacturers actually do?

Manufacturers must assess cybersecurity risk, meet the essential requirements in Annex I, document the result and keep handling vulnerabilities for a stated support period. In practice that turns into a set of engineering and governance habits rather than a single audit event.

• Risk assessment: Assess cybersecurity risk for the product and use it to decide how each essential requirement applies.
• Secure design and defaults: Build to the Annex I requirements throughout planning, design, development and maintenance.
• Component due diligence: Check third-party components, including open source, and identify them. Recital 77 expects a software bill of materials but says it need not be public. Our SBOM guide for the CRA covers that piece in depth.
• Support period: Tell buyers the end date, by month and year, at the time of purchase. Article 13(8) requires a support period of at least five years, unless the product is expected to be in use for less time.
• Technical documentation: Keep it ready for market surveillance authorities.
• Declaration and CE marking: Draw up the EU declaration of conformity and affix the CE mark after a successful assessment.

Start by naming an owner. In our experience, CRA programs stall when product, security and legal each assume another team is leading.

Which conformity assessment route applies?

Your route depends on how the product is classified, and most products can self-assess. The Commission summary sets out the options, with product categories listed in Annexes III and IV and described further in Implementing Regulation (EU) 2025/2392.

Product class	Route
Default	Self-assessment, a notified body, or a certification scheme where specified
Important, class I	Self-assessment only if harmonised standards, common specifications or a certification scheme were applied. Otherwise a notified body
Important, class II	Third-party assessment, or a certification scheme where available
Critical	Third-party assessment, or a certification scheme where available. No self-assessment

Check your classification early. If you land in class I, the availability of harmonised standards decides whether you can self-assess, and the Commission's timeline expects standardisation work to continue through October 2027.

How does CRA incident and vulnerability reporting work?

Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security on a fixed clock, through a single EU platform. ENISA's FAQ confirms that the Single Reporting Platform became operational on 11 September 2026, and that notifications reach the CSIRT for the manufacturer's main EU establishment.

The clock runs from when you become aware of the issue:

Step	Deadline
Early warning	Within 24 hours
Notification with initial assessment	Within 72 hours
Final report, actively exploited vulnerability	No later than 14 days after a fix or mitigation is available
Final report, severe incident	Within one month of the 72-hour notification

If you have not yet prepared, three actions close most of the gap:

1. Create your organization's account on the platform before you need it. ENISA requires EU Login with multi-factor authentication.
2. Add a CRA decision point to your incident runbook, so that on-call staff know what triggers the 24-hour clock.
3. Inventory every in-scope product already on the EU market, because the duty covers them too.

What happens if you do not comply?

Member States enforce the CRA through national market surveillance authorities, and fines can reach the higher of EUR 15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements or the Article 13 and 14 duties. Article 64 sets lower ceilings for other failures:

Breach	Maximum fine
Essential requirements, Articles 13 and 14	EUR 15 million or 2.5% of worldwide annual turnover
Other listed obligations	EUR 10 million or 2% of worldwide annual turnover
Incorrect or misleading information to authorities	EUR 5 million or 1% of worldwide annual turnover

Two carve-outs matter for smaller teams. Microenterprises and small enterprises cannot be fined for missing the 24-hour early warning deadline, and open-source software stewards are not subject to these fines. The commercial risk can be just as serious, since non-conforming products may lose access to the EU market.

How SecureSlate helps

The CRA does not have a built-in framework page in SecureSlate today, so you would set it up as a custom framework with your own controls and map them to programs you already run, such as ISO 27001 or NIS 2. From there, SecureSlate supports the surrounding work:

• Custom frameworks and controls to track CRA duties alongside SOC 2, ISO 27001 and NIS 2
• Code security and secrets detection to surface issues in your repositories
• Vendor risk management for third-party due diligence
• Risk management and audit management to keep assessments and evidence in one place

SecureSlate does not perform CRA conformity assessments, issue declarations or file reports on your behalf.

Start a SecureSlate trial to set up your CRA control set.

FAQ

Does the Cyber Resilience Act apply to SaaS?

Usually not on its own. Recital 12 notes that NIS 2 applies to SaaS, and a cloud service only falls under the CRA when it is remote data processing that a product needs to perform a function.

Is open-source software covered by the CRA?

Free and open-source software is outside the rules when not supplied in a commercial activity. Open-source software stewards have lighter duties under Article 24, and their reporting duties begin on 11 December 2027.

Do I need to report vulnerabilities in products sold before 2027?

Yes. The reporting obligations have applied since 11 September 2026, including to products that were placed on the market before 11 December 2027.

How long must a product be supported under the CRA?

Article 13(8) requires a support period of at least five years, unless the product is expected to be in use for a shorter time. Manufacturers must state the end date clearly at purchase.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.