Frequently asked questions

It does if your product meets all three conditions and no exclusion applies:

• It is a product with digital elements: software or hardware, including a component sold on its own, plus the remote data processing it needs to work
• It is made available on the EU market: supplied in the course of a commercial activity, paid or free
• Its intended purpose or reasonably foreseeable use includes a direct or indirect connection to a device or network

The CRA itself excludes only these:

• Products under the EU rules on medical devices, in vitro diagnostic medical devices or motor vehicle type-approval
• Civil aviation products certified under Regulation (EU) 2018/1139
• Marine equipment under Directive 2014/90/EU
• Spare parts that replace identical components and are made to the same specifications
• Products developed or modified exclusively for national security or defence, or specifically designed to process classified information

Other sector laws do not limit or exclude a product by themselves. That takes a Commission delegated act, and only where their rules protect at least as well.

Delegated Regulation (EU) 2025/1535 does this for products under the EU rules on two- and three-wheel vehicles and quadricycles, except L1e vehicles designed to pedal.

Being free does not take a product out of scope. The CRA covers supply in the course of a commercial activity, paid or free.

The Regulation does not define commercial activity, but the recitals give indicators, such as charging above cost for technical support, monetising other services through the product, or requiring personal data for reasons other than security, compatibility or interoperability.

A spare part is outside the CRA only if it replaces an identical component and is made to the same specifications.

That covers parts for products made available before the CRA applies, and parts that have already been through a CRA conformity assessment.

The Commission's non-binding guidance applies this only to parts supplied specifically to repair a product already on the market or extend its life.

Default, unless its core functionality matches a listed category: 19 Class I or 4 Class II categories of important products in Annex III, or 3 critical ones in Annex IV.

Embedding a listed function, such as a firewall, is not enough.

Implementing Regulation (EU) 2025/2392 describes each category, and your class sets your conformity assessment route.

Only when it is supplied in the course of a commercial activity. The recitals indicate the test is whether its manufacturer monetises it, not how it was developed or funded.

An open-source software steward, a legal person other than a manufacturer that gives sustained support to open-source software intended for commercial activities, has light-touch duties under Article 24 from 11 December 2027.

Administrative fines do not apply to stewards.

A standalone online service is not itself a product with digital elements. It is covered only as a product's remote data processing, which means all of these:

• It processes data at a distance
• Its software is designed and developed by the product's manufacturer, or under its responsibility
• Without it, the product could not perform one of its functions

The Commission's non-binding guidance adds that browser-only web apps and information-only websites are out of scope unless they support a product's functionality.

Yes, if your product is made available on the EU market.

You may appoint an authorised representative in the EU by written mandate, but you cannot hand it core duties such as design or vulnerability handling.

The Commission's non-binding FAQ takes the view that a manufacturer outside the EU is required to have an importer, an authorised representative or a fulfilment service provider.

They are in Annex I and apply from 11 December 2027:

• Part I: 13 requirements for the product itself, such as a secure default configuration, applied on the basis of your cybersecurity risk assessment and only where applicable
• Part II: eight vulnerability handling duties, such as fixing vulnerabilities without delay, from placing on the market to the end of the support period

Yes. Annex I Part II requires a software bill of materials in a commonly used and machine-readable format, covering at least the top-level dependencies, not necessarily every nested one.

You do not have to publish it, but a market surveillance authority can ask for it on a reasoned request.

It is the period during which you must handle the product's vulnerabilities effectively under Annex I Part II, including through security updates.

It must be at least five years, or the expected use time if the product is expected to be in use for less.

You must state its end date, at least the month and year, at the time of purchase.

Yes, unless you and a business user agree otherwise for a tailor-made product. That exception never covers consumers.

Each security update released during the support period must stay available for at least 10 years after issue, or for the rest of the support period, whichever is longer.

Since 11 September 2026, you must notify actively exploited vulnerabilities in your product and severe incidents affecting its security.

Send each notification through ENISA's single reporting platform, to the CSIRT designated as coordinator and ENISA at the same time, by these deadlines:

• Early warning: without undue delay, within 24 hours of becoming aware
• Notification: without undue delay, within 72 hours of becoming aware
• Final report, vulnerability: within 14 days of a fix or mitigation being available
• Final report, severe incident: within one month of the incident notification

No. Mandatory reporting covers only actively exploited vulnerabilities and severe incidents. A vulnerability counts as actively exploited when there is reliable evidence that a malicious actor exploited it in a system without the owner's permission.

A vulnerability found in good faith with no malicious exploitation need not be reported, though you may report it voluntarily.

A ready fix does not remove the duty: the early warning is still due within 24 hours.

Yes. ENISA's single reporting platform, at portal.cra-srp.enisa.europa.eu, has been operational since 11 September 2026 for mandatory Article 14 notifications.

It does not yet take voluntary reports under Article 15; you can make those to a CSIRT designated as coordinator.

The legal 72-hour deadline runs from when you became aware, whatever the platform shows.

Keep the technical documentation and EU declaration of conformity available to market surveillance authorities for at least 10 years after placing on the market, or the support period, whichever is longer.

The same applies to the user information and instructions, including online.

An importer keeps a copy of the declaration for the same period and makes sure the technical documentation can be provided on request.

An importer selling under its own name or trademark, or an importer or distributor that substantially modifies a product, is treated as the manufacturer.

Your duties depend on your role:

• Importer: place on the market only products that meet Annex I
• Importer: before that, check that the conformity assessment was done and that the technical documentation, CE marking, EU declaration of conformity and user information exist
• Importer: add your name and contact details to the product, its packaging or an accompanying document
• Distributor: check the CE marking, and that the manufacturer and importer met specific duties, such as supplying the user information and declaration

It entered into force on 10 December 2024 and applies in stages:

• Rules on notified bodies (Chapter IV): since 11 June 2026
• Reporting duties (Article 14): since 11 September 2026, also for products placed on the market before 11 December 2027
• Everything else, including the essential requirements and CE marking: from 11 December 2027

Administrative fines have three ceilings, each a fixed sum or a share of total worldwide annual turnover for the preceding financial year:

• EUR 15 million or 2.5 %, whichever is higher: breaching the essential requirements or the obligations in Articles 13 and 14
• EUR 10 million or 2 %, whichever is higher: breaching other listed obligations, including those of authorised representatives, importers and distributors
• EUR 5 million or 1 %, whichever is higher: giving notified bodies or market surveillance authorities incorrect, incomplete or misleading information

Micro and small enterprises are not fined for missing the 24-hour early warning deadline, but must still report.

Open-source software stewards face no administrative fines.

Products placed on the market before 11 December 2027 need to comply only if substantially modified from that date, but Article 14 reporting already applies to them (see the next question).

EU type-examination certificates and approval decisions on cybersecurity issued under other EU product laws stay valid until 11 June 2028, unless they expire earlier or that law says otherwise.

Yes. Article 14 applies to all in-scope products placed on the market before 11 December 2027, so since 11 September 2026 you must notify their actively exploited vulnerabilities and severe incidents within the usual deadlines.

The Commission's non-binding guidance adds that reporting continues after support ends, and that you need not report a vulnerability whose active exploitation you knew about before 11 September 2026.

You affix it yourself before placing the product on the market, after a conformity assessment shows it meets Annex I. Routes by class:

• Default: you can self-assess (internal control, module A)
• Class I: self-assessment only if you apply harmonised standards, common specifications or an EU cybersecurity certification scheme in full; otherwise a third party
• Class II: a third party
• Critical: a European cybersecurity certification scheme where Article 8(1) applies; otherwise the Class II third-party procedures

Hardware carries the marking visibly, legibly and indelibly on the product or, where its nature makes that impossible or unwarranted, on its packaging and accompanying declaration. Software carries it on its declaration or accompanying website.

Under module H, the notified body's identification number follows the marking.

When it is a substantial modification: a change after placing on the market that affects compliance with Annex I Part I, or changes the intended purpose the product was assessed for.

A security update meant to reduce risk is not one, as long as the intended purpose stays the same.

The product then needs its compliance checked again and, where applicable, a new conformity assessment. The Commission's non-binding guidance says that assessment can focus on the modified parts, unless the change harms the whole product's cybersecurity.

Reporting has applied since 11 September 2026: if you are in scope, be ready to send an early warning within 24 hours of becoming aware. Then run the scope check and the class finder.

EN 40000 is a series of European standards for the CRA, and every part is still a draft:

• Draft EN 40000-1-1: cybersecurity vocabulary
• Draft EN 40000-1-2: principles, product risk management, and lifecycle activities
• Draft EN 40000-1-3: vulnerability handling

You cannot certify against a draft, and it gives no presumption of conformity. Under Article 27(1), only harmonised standards whose references are published in the Official Journal of the EU do.

Draft status does not delay the Annex I essential requirements, which apply from 11 December 2027.

No. This site and its tools are an education and documentation resource, not legal, regulatory or conformity assessment advice.

They issue no CE markings or certificates, and a tool result is a likely outcome, not a decision.