A guide to the Cyber Resilience Act
What Regulation (EU) 2024/2847 covers, what manufacturers must do, and which dates have already passed.
Last reviewed: 15 October 2026
1.What the CRA is
The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847. It sets cybersecurity requirements for products with digital elements: software and hardware products, the remote data processing they need, and components placed on the market on their own.
The requirements are in Annex I: Part I for the product itself, Part II for how the manufacturer handles vulnerabilities.
Once a conformity assessment shows that a product meets them, the manufacturer draws up an EU declaration of conformity and affixes the CE marking before placing the product on the market.
The Regulation has been in force since 10 December 2024 and takes effect in stages. The reporting duties already apply; the essential requirements follow on 11 December 2027 (section 8).
Sources: CRA Art. 3(1); CRA Annex I; CRA Art. 13(12); CRA Art. 30(3); CRA Art. 71
2.Who it applies to
- Covered: a product meant or reasonably expected to connect to a device or network, supplied on the EU market, paid or free.
- The CRA itself excludes medical devices, motor vehicles, certified civil aviation products and marine equipment under their own EU rules, like-for-like spare parts, and products made only for national security or defence or to process classified information.
- Also covered: an online service that is a product's remote data processing, open-source software supplied commercially, and the products of manufacturers outside the EU.
Read the full section
A product with digital elements is covered when two conditions hold. It is made available on the EU market, that is, supplied in the course of a commercial activity, paid or free. And its intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network.
The CRA itself excludes only these:
- Products under the EU rules on medical devices, in vitro diagnostic medical devices or motor vehicle type-approval
- Civil aviation products certified under Regulation (EU) 2018/1139
- Marine equipment within Directive 2014/90/EU
- Spare parts that replace identical components and are made to the same specifications
- Products developed or modified exclusively for national security or defence, or specifically designed to process classified information
Another sector law excludes a product only through a Commission delegated act, and only where its rules protect at least as well. Delegated Regulation (EU) 2025/1535 is one: it excludes products under the EU rules on two- and three-wheel vehicles and quadricycles, except L1e vehicles designed to pedal.
An online service is covered only as part of a product, as its remote data processing: it processes data at a distance, its software is designed and developed by the product's manufacturer or under its responsibility, and the product could not perform one of its functions without it.
Free and open-source software is covered only when supplied in the course of a commercial activity; the recitals indicate the test is whether its manufacturer monetises it. A manufacturer outside the EU is covered when its product is made available on the EU market. It may appoint an authorised representative in the EU by written mandate, but cannot hand it core duties such as design or vulnerability handling.
Check your product: Scope check
Sources: CRA Art. 2; CRA Art. 3(1), (2) and (22); CRA Art. 18(1) and (2); CRA recital 12; CRA recital 18; Delegated Regulation (EU) 2025/1535, Art. 1
3.Product classes
The class decides the conformity assessment route (section 5). A product is default unless its core functionality matches one of the 26 categories named in Annexes III and IV:
- Default: any product whose core functionality is not one of the 26
- Important I (Annex III, Class I, 19 categories): for example password managers, products with a VPN function, operating systems, and routers, internet modems and switches
- Important II (Annex III, Class II, 4 categories): hypervisors and container runtime systems, firewalls and intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers
- Critical (Annex IV, 3 categories): hardware devices with security boxes, smart meter gateways and other advanced security devices, and smartcards and secure elements
Containing a listed function is not enough: an embedded firewall does not make a product Important II. In the Commission's non-binding guidance, a product has only one core functionality when its route is decided, so it falls into one category, not the strictest of several.
Implementing Regulation (EU) 2025/2392 describes each category technically; the product class finder lists all 26.
Find your likely class: Product class finder
Sources: CRA Annex III; CRA Annex IV; CRA Art. 32; Implementing Regulation (EU) 2025/2392; Commission guidance C(2026) 5252 final (non-binding)
4.Key obligations
- From 11 December 2027: the 13 Part I requirements, applied on the basis of your risk assessment and only where applicable, and eight Part II vulnerability handling duties, an SBOM among them.
- Before placing on the market: technical documentation (Annex VII) and user information (Annex II).
- Keep the documentation and the EU declaration of conformity available to market surveillance authorities for at least 10 years after placing on the market, or the support period if longer.
Read the full section
Annex I holds the essential cybersecurity requirements, which apply from 11 December 2027. Part I starts from one rule: a level of cybersecurity appropriate to the risks. Its 13 specific requirements apply on the basis of your cybersecurity risk assessment and only where applicable.
So the risk assessment comes first. Your technical documentation records how each Part I requirement applies, with a clear justification for any that does not.
Part II sets eight vulnerability handling duties that run from placing on the market to the end of the support period (section 7). They include fixing vulnerabilities without delay, testing security regularly, enforcing a coordinated vulnerability disclosure policy and drawing up a software bill of materials (SBOM). The SBOM must be in a commonly used, machine-readable format and cover at least the top-level dependencies. You need not publish it, but a market surveillance authority can ask for it on a reasoned request.
Before placing the product on the market, draw up technical documentation containing at least the items in Annex VII, and keep it updated where appropriate, at least during the support period. The product must come with the user information in Annex II, including a contact point for reporting vulnerabilities and the end date of the support period.
Keep the technical documentation and the EU declaration of conformity available to market surveillance authorities, and the user information available to users and those authorities, for at least 10 years after placing on the market, or for the support period, whichever is longer.
Work through each duty: Compliance matrix
Sources: CRA Annex I, Parts I and II; CRA Art. 13(4), (13) and (18); CRA Art. 31(1) and (2); CRA Annex II; CRA Annex VII; CRA Art. 71(2)
5.Conformity assessment and CE marking
- Default products can be self-assessed (module A).
- Important I: self-assessment only with harmonised standards, common specifications or a certification scheme (level "substantial" or higher) applied in full; otherwise a notified body.
- Important II and critical: a notified body or a European cybersecurity certification scheme.
- Then the EU declaration of conformity, and the CE marking before the product goes on the market.
Read the full section
Article 32 sets the procedures. Under module A, internal control, you assess the product yourself. Module B followed by module C, and module H, involve a notified body. Where one is available and applicable, a European cybersecurity certification scheme can be used instead. By class:
- Default: any of them, so you can self-assess under module A
- Important I: module A only if you fully apply harmonised standards, common specifications or a certification scheme at assurance level "substantial" or higher; otherwise module B with C, or module H
- Important II: module B with C, module H, or a certification scheme at assurance level "substantial" or higher, where available and applicable
- Critical: a European cybersecurity certification scheme where the conditions in Article 8(1) are met; otherwise one of the Important II procedures
If an Annex III product is free and open-source software, its manufacturer may use any procedure, module A included, provided the technical documentation is made public when the product is placed on the market. This option does not cover critical products.
Once conformity is shown, draw up the EU declaration of conformity with the content Annex V lists, in the languages required by each Member State where the product is placed or made available on the market. Drawing it up makes the manufacturer responsible for the product's compliance. A copy, or a simplified declaration giving the exact internet address of the full one, goes with the product.
Affix the CE marking before placing the product on the market. Hardware carries it visibly, legibly and indelibly on the product or, where the product's nature makes that impossible or unwarranted, on its packaging and accompanying declaration. Software carries it on its declaration or accompanying website. Under module H, the notified body's identification number follows the marking.
Draft your declaration: Declaration of conformity drafter
Sources: CRA Art. 32; CRA Art. 28; CRA Annex V; CRA Art. 13(12) and (20); CRA Art. 30
6.Reporting duties
Two kinds of event must be notified: an actively exploited vulnerability in your product, and a severe incident having an impact on its security. The duty has applied since 11 September 2026, also to products placed on the market before 11 December 2027. A vulnerability counts as actively exploited when there is reliable evidence that a malicious actor exploited it in a system without the owner's permission.
Each notification goes through ENISA's single reporting platform, to the CSIRT designated as coordinator and to ENISA at the same time:
- Early warning: without undue delay, within 24 hours of becoming aware
- Notification: without undue delay, within 72 hours of becoming aware
- Final report on a vulnerability: no later than 14 days after a corrective or mitigating measure is available
- Final report on a severe incident: within one month of the incident notification
A ready fix does not remove the duty to notify; it only starts the 14-day final-report clock. Micro and small enterprises are not fined for missing the 24-hour early warning deadline, but must still notify.
You must also inform the impacted users, and where appropriate all users, of the vulnerability or incident and, where necessary, of mitigation and corrective measures they can take. Article 14(8) sets no fixed deadline for this.
The platform, at portal.cra-srp.enisa.europa.eu, has been operational since 11 September 2026. It does not yet take voluntary reports under Article 15, such as a near miss; send those to a CSIRT designated as coordinator.
Sources: CRA Art. 3(42); CRA Art. 14; CRA Art. 15; CRA Art. 16; CRA Art. 64(10)(a); CRA Art. 69(3); CRA recital 120; ENISA single reporting platform pages; Commission CRA reporting page (fetched 2026-10-15)
7.Support period and updates
The support period is the time during which you must keep handling the product's vulnerabilities under Annex I Part II. You set it to reflect how long the product is expected to be in use, taking account of reasonable user expectations, the product's nature and intended purpose, and relevant EU law on product lifetime.
It must be at least five years. If the product is expected to be in use for less, the period matches that expected use time instead.
At the time of purchase, state when support ends, at least the month and year, clearly and in an easily accessible way. Where technically feasible, you must also display a notice telling users that the product has reached the end of its support period.
Security updates must be free of charge, unless you and a business user agree otherwise for a tailor-made product. Release them without delay with advisory messages, separately from functionality updates where technically feasible. Each one released during the support period must stay available for at least 10 years after it is issued, or for the rest of the support period, whichever is longer.
Work out your support period: Support period planner
Sources: CRA Art. 13(8), (9) and (19); CRA Annex I, Part II, points (2) and (8); CRA Annex II, point 7
8.Timeline and penalties
- Already applying: the notified body rules (since 11 June 2026) and Article 14 reporting (since 11 September 2026), also for products placed on the market before 11 December 2027.
- The rest applies from 11 December 2027. A product placed on the market before then must comply only if substantially modified from that date.
- The top fine, for breaching the essential requirements or Articles 13 and 14: EUR 15 million or 2.5 % of total worldwide annual turnover, whichever is higher.
Read the full section
The CRA applies in stages. The rules on notified bodies and the reporting duties already apply:
- 20 November 2024: published in the Official Journal of the EU
- 10 December 2024: entered into force
- 29 October 2025: Delegated Regulation (EU) 2025/1535, adopted on 29 July 2025, published; in force from the twentieth day following publication
- 11 June 2026: the rules on notified bodies (Chapter IV) have applied since this date
- 11 September 2026: the Article 14 reporting duties have applied since this date, and ENISA's single reporting platform has been operational since then
- 11 December 2027: everything else applies, including the essential requirements and CE marking
- 11 June 2028: EU type-examination certificates and approval decisions on cybersecurity issued under other EU product laws stay valid until this date, unless they expire earlier or that law says otherwise
A product placed on the market before 11 December 2027 needs to meet the CRA's requirements only if it is substantially modified from that date, but Article 14 reporting has applied to it since 11 September 2026. In the non-binding Blue Guide and Commission FAQ, placing on the market counts per unit for hardware, so new units of an older model placed from 11 December 2027 must comply.
Administrative fines have three ceilings, each a fixed sum or a share of total worldwide annual turnover for the preceding financial year. Breaching the essential requirements or the obligations in Articles 13 and 14 can cost up to EUR 15 million or 2.5 %, whichever is higher.
Other listed obligations, including those on the declaration of conformity, CE marking and conformity assessment and those of importers and distributors, carry up to EUR 10 million or 2 %, whichever is higher. Giving notified bodies or market surveillance authorities incorrect, incomplete or misleading information carries up to EUR 5 million or 1 %, whichever is higher. Open-source software stewards face no administrative fines.
Sources: CRA Art. 64; CRA Art. 69; CRA Art. 71; Delegated Regulation (EU) 2025/1535; Commission CRA reporting page; Blue Guide 2022, section 2.2 (non-binding); Commission FAQ (non-binding)
9.EN 40000 (draft)
EN 40000 is a series of European standards being written for the CRA, and every part is still a draft:
- Draft EN 40000-1-1: cybersecurity vocabulary
- Draft EN 40000-1-2: principles, product risk management, and lifecycle activities
- Draft EN 40000-1-3: vulnerability handling
CEN/CLC/JTC 13 prepares the drafts under standardisation request M/606, which also asks for generic security requirements and for product-specific standards. The series is still being drafted, and its clause numbers may change.
You cannot certify against a draft, and it gives no presumption of conformity. Under Article 27(1), presumption comes only from harmonised standards whose references are published in the Official Journal of the EU, so even a finished part gives none until its reference appears there.
Draft status does not delay Annex I, which applies from 11 December 2027. The compliance matrix shows where the drafts address each duty.
Sources: CRA Art. 27(1); CRA Art. 71(2); draft EN 40000-1-1, draft EN 40000-1-2, draft EN 40000-1-3 (CEN/CLC/JTC 13); CEN, CENELEC and ETSI work programme for M/604 and M/606 (V1, 2 April 2025)
10.What to do next
Start with the duty that already applies. If your product is in scope, reporting has applied since 11 September 2026, so be ready to send an early warning within 24 hours of becoming aware of either kind of event (section 6).
The tools run in your browser and give likely outcomes, not decisions:
- Scope check: whether the CRA likely applies to your product
- Product class finder: your likely class and conformity assessment route
- Support period planner: your minimum support period and the dates that follow from it
- Declaration of conformity drafter: a draft declaration covering each Annex V item
- Compliance matrix: manufacturer duties by lifecycle stage, each with its source
- FAQ: short answers by topic
Compass, our free guided assessment for SMEs, also checks organisational maturity and reporting readiness. Try Compass free
Sources: CRA Art. 14; CRA Art. 71(2)