111% more reported CVEs per day in 2026 than last year.Come say hello at booth T14 at Cybersec Expo in Amsterdam on 19–20 October.

What is the Cyber Resilience Act?

The EU law that sets cybersecurity rules for hardware and software products, and what it asks of the companies that make them

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is an EU regulation that sets mandatory cybersecurity requirements for products with digital elements: hardware and software that connect to a device or network, from routers and smart home devices to apps, operating systems and software components sold on their own. It entered into force on December 10, 2024. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since September 11, 2026, and the rest of the regulation applies from December 11, 2027.

Manufacturers carry most of the obligations. They assess cybersecurity risk, build products to the essential requirements in Annex I, keep a software bill of materials (SBOM), handle vulnerabilities for a support period of at least five years, pass a conformity assessment and affix the CE marking. Importers and distributors check that this was done. Fines reach €15 million or 2.5% of worldwide annual turnover.

CRACI automates a significant part of the evidence these obligations need: it records the components each build pulls in as an SBOM, re-checks them against new vulnerabilities after you ship, and exports audit evidence for your technical documentation. When a vulnerability has to be reported, CRACI submits the CRA notifications to the authorities on your behalf. See how CRACI supports CRA compliance.

What the Cyber Resilience Act asks manufacturers to do

The scope of Regulation (EU) 2024/2847, the dates it takes effect, the reporting deadlines, and where the SBOM and vulnerability handling obligations sit.

Petteri Pulkkinen and Erika Marttinen at Kubernetes Community Days Helsinki 2026, 8:03 to 15:20 of SBOMbastic: Getting Ready for Upcoming EU Cybersecurity Regulation in Software Supply Chains.

Key dates

Date What happens
October 23, 2024 Regulation (EU) 2024/2847 adopted by the European Parliament and the Council
November 20, 2024 Published in the Official Journal of the European Union
December 10, 2024 Entered into force
June 11, 2026 Rules on notifying conformity assessment bodies (Chapter IV) apply
September 11, 2026 Reporting of actively exploited vulnerabilities and severe incidents (Article 14) applies, including for products already on the market
December 11, 2027 The rest of the regulation applies

Key Aspects of the CRA

Mandatory Security Requirements

Products must meet the essential cybersecurity requirements in Annex I when they are placed on the market and throughout their support period.

Risk-Based Classification

Most products are default category. Important and critical products face stricter conformity assessment routes.

Vulnerability Handling

Manufacturers keep an SBOM, fix vulnerabilities without delay and report actively exploited ones within 24 hours.

CE Marking

After a conformity assessment, the manufacturer signs an EU declaration of conformity and affixes the CE marking.

Documentation & Transparency

Technical documentation is kept for at least 10 years or the support period, and users learn when support ends.

Market Surveillance

National authorities can request documentation, order corrective action or recalls, and impose fines.

The CRA timeline is ticking

Key milestones you need to prepare for under the Cyber Resilience Act.

Notified body rules apply
June 2026
Vulnerability reporting enforcement
September 2026
We are here
Full application of the CRA act
December 2027
€15M
maximum fine, or 2.5% of global annual turnover
24 hours
to send an early warning of an actively exploited vulnerability
72 hours
to follow up with a full vulnerability notification

Who Does the CRA Affect?

Manufacturers

Anyone who develops or manufactures a product with digital elements, or has one made, and markets it under their own name or trademark, whether for payment or free of charge. Manufacturers outside the EU are covered when they sell into it.

Importers & Distributors

Importers and distributors must check that a product carries the CE marking and that the manufacturer met its obligations before they make it available in the EU.

Open Source Software

Only open source supplied in the course of a commercial activity is covered. Open-source software stewards follow a light-touch regime, and manufacturers remain responsible for the open-source components they build in.

Software and SaaS Providers

Software sold as a product is covered, as is the cloud backend a product needs to work. Software as a service on its own falls under NIS2 rather than the CRA.

Out of scope: products already regulated by the EU medical device, in vitro diagnostic and vehicle type-approval rules, certified aviation products, marine equipment, identical spare parts, and products built exclusively for national security or defense (Article 2).

Product categories and conformity assessment

Every manufacturer carries out a conformity assessment before placing a product on the market. The route depends on the product's category.

Category Examples Conformity assessment
Default Most products with digital elements that are not listed in Annex III or IV Self-assessment (internal control) is allowed
Important, class I (Annex III) Identity and access management, browsers, password managers, VPNs, operating systems, routers and switches, smart home security products Self-assessment only when harmonised standards, common specifications or a certification scheme are applied; otherwise a notified body
Important, class II (Annex III) Hypervisors and container runtimes, firewalls and intrusion detection systems, tamper-resistant microprocessors and microcontrollers Third-party assessment by a notified body, or a European cybersecurity certification scheme
Critical (Annex IV) Hardware devices with security boxes, smart meter gateways, smartcards and secure elements A European cybersecurity certificate where the Commission requires one; otherwise third-party assessment

Essential Requirements

Annex I sets two groups of essential requirements. The first covers the product itself, based on a documented cybersecurity risk assessment:

  • No known exploitable vulnerabilities when the product is placed on the market
  • A secure by default configuration
  • Security updates, automatic by default where applicable
  • Protection against unauthorized access, and of the confidentiality and integrity of data
  • Data minimization, availability of essential functions and a limited attack surface
  • Secure, permanent removal of user data and settings

The second covers how the manufacturer handles vulnerabilities:

  • An SBOM covering at least the top-level dependencies
  • Fixing vulnerabilities without delay, with security updates separate from feature updates where feasible
  • Regular security testing and reviews
  • A coordinated vulnerability disclosure policy and a contact for reporting vulnerabilities
  • Public disclosure of fixed vulnerabilities once an update is available
  • Secure distribution of updates, free of charge, with advisory messages

Manufacturers also set a support period of at least five years unless the product is expected to be in use for less, keep each security update available for at least 10 years, and keep the technical documentation and EU declaration of conformity for at least 10 years or the support period, whichever is longer (Article 13).

Reporting obligations and timelines

Since September 11, 2026, manufacturers notify actively exploited vulnerabilities and severe incidents through the Single Reporting Platform, to the CSIRT designated as coordinator in their main EU Member State and to ENISA at the same time (Article 14). This applies to products already on the market too.

Step Actively exploited vulnerability Severe incident
Early warning Within 24 hours of becoming aware Within 24 hours of becoming aware
Notification Within 72 hours, with details of the product, the exploit and any mitigations Within 72 hours, with an initial assessment and any mitigations
Final report No later than 14 days after a corrective or mitigating measure is available Within one month of the incident notification

Manufacturers must also inform affected users, and where appropriate all users, with mitigation steps they can take. Meeting a 24-hour clock depends on knowing within hours which products and releases contain the vulnerable component, which is what a per-release SBOM is for.

Penalties

Member States set the penalties, within these maximums (Article 64). Market surveillance authorities can also order corrective action, withdrawal or recall of a product.

Breach Maximum administrative fine
Essential cybersecurity requirements (Annex I) and manufacturer obligations (Articles 13 and 14) Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher
Other obligations, including those of importers and distributors, the declaration of conformity, CE marking, technical documentation and conformity assessment Up to €10 million or 2% of total worldwide annual turnover, whichever is higher
Incorrect, incomplete or misleading information given to notified bodies or market surveillance authorities Up to €5 million or 1% of total worldwide annual turnover, whichever is higher

Micro and small enterprises are not fined for missing the 24-hour early warning deadline, and open-source software stewards are not fined for any infringement.

Open source and the CRA

Free and open-source software is covered only when it is supplied in the course of a commercial activity, and hosting a project on an open repository or package manager does not by itself make it available on the market. Open-source software stewards, legal persons such as foundations that support open-source projects intended for commercial use, must have a documented cybersecurity policy, cooperate with market surveillance authorities and report actively exploited vulnerabilities to the extent they are involved in development (Article 24).

For manufacturers, open source is a component like any other. They must exercise due diligence when integrating it, report vulnerabilities they find to the project that maintains it, and share fixes they develop (Article 13). That is why the SBOM matters: it is the record of which open-source components, in which versions, ship in each release.

What the CRA means for development teams

A product today is mostly other people's code: open-source libraries, packages pulled from registries, container base images, third-party SDKs, and the build tools and CI/CD pipelines that assemble them. The SolarWinds attack went through a build system, and Log4Shell was a vulnerability in a widely used library; both reached finished products. The CRA makes the manufacturer responsible for all of it, including due diligence on the third-party and open-source components it builds in (Article 13).

In practice, teams preparing for the CRA:

  • Know what ships in each release, by producing an SBOM from each build in a machine-readable format such as CycloneDX or SPDX instead of once at release time
  • Monitor released versions, not only the main branch, because a vulnerability found after release still has to be fixed without delay during the support period
  • Agree dependency policies: how new components are chosen and reviewed, how fast updates land, and which findings block a release
  • Rehearse the 24-hour clock: who confirms active exploitation, who files the early warning and who informs users
  • Keep evidence as they go, since build records, SBOMs and test results feed the technical documentation that must be kept for at least 10 years

For the requirements as a step-by-step roadmap, see the CRA guide. See also what the CRA asks of an SBOM and how CRACI supports CRA compliance.

Cyber Resilience Act FAQ

Short answers to the questions manufacturers ask most about the CRA

What is the Cyber Resilience Act?

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is an EU regulation that sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. It makes manufacturers responsible for security from design through a support period of at least five years, including vulnerability handling, an SBOM and reporting of actively exploited vulnerabilities.

When does the Cyber Resilience Act apply?

It entered into force on December 10, 2024. The reporting obligations in Article 14 apply from September 11, 2026, the rules on conformity assessment bodies from June 11, 2026, and the rest of the regulation from December 11, 2027.

Does the CRA apply to software and SaaS?

Software sold or supplied as a product is covered, including apps, operating systems, firmware and software components placed on the market separately. Cloud services are covered only as the remote data processing of a product, for example the cloud backend that lets you control a smart home device. Software as a service on its own falls under NIS2 instead (recital 12).

Does the CRA apply to open-source software?

Only open source supplied in the course of a commercial activity. Non-commercial open-source projects are outside its scope. Open-source software stewards, such as foundations that support projects intended for commercial use, follow a light-touch regime and cannot be fined. Manufacturers that build open-source components into their products remain fully responsible for them.

What are the CRA reporting requirements?

Manufacturers notify actively exploited vulnerabilities and severe incidents through the Single Reporting Platform to their coordinating CSIRT and ENISA: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix for vulnerabilities or within one month for incidents. They also inform affected users.

Does the CRA require an SBOM?

Yes. Annex I, Part II requires a software bill of materials in a commonly used, machine-readable format covering at least the top-level dependencies. It is part of the technical documentation and goes to a market surveillance authority on request; it does not have to be published.

What are the penalties under the CRA?

Up to €15 million or 2.5% of worldwide annual turnover for breaching the essential requirements or the manufacturer obligations, up to €10 million or 2% for other obligations, and up to €5 million or 1% for misleading authorities. Micro and small enterprises are not fined for missing the 24-hour early warning deadline.

Does the CRA apply to products already on the market?

The reporting obligations do, from September 11, 2026. Otherwise, products placed on the market before December 11, 2027 fall under the CRA only if they are substantially modified after that date.

Get the evidence your CRA process needs

See how CRACI records SBOMs from your builds, monitors what you shipped and submits CRA notifications on your behalf

Book a demo Check if the CRA applies to you