The EU Cyber Resilience Act (CRA) (Regulation (EU) 2024/2847) is an EU-wide regulation. It applies to products with digital elements that connect, directly or indirectly, to another device or network. The CRA entered into force in December 2024, and its requirements are being introduced in stages.
Until now, there has been no single cybersecurity baseline for all hardware and software products placed on the EU market. Connected products with weak security are a common entry point for attackers. The CRA makes cybersecurity a condition of market access, much like product safety. Compliance is reflected in the CE marking.
Here are the key elements of the EU Cyber Resilience Act.
Table of Contents
- Who does the EU Cyber Resilience Act apply to?
- What does the CRA require?
- CRA timeline: key dates to remember
- CE marking and conformity assessment
- Penalties for non-compliance and how to prepare
- How CertX / SGS can help
- Further information and official sources
1. Who does the EU Cyber Resilience Act apply to?
The CRA has a broad scope. It covers products with digital elements: hardware and software whose intended or reasonably foreseeable use includes a direct or indirect data connection to another device or network.
In practice, this includes:
- Connected hardware. Examples include routers, smart home devices, wearables, industrial sensors, controllers and machines with network interfaces.
- Standalone software. This includes operating systems, applications, firmware and software components placed on the EU market, including many B2B products.
- Remote data processing linked to the product. Cloud functions that are necessary for the product to perform its functions are also within scope.
The CRA covers the entire supply chain, not just manufacturers. Manufacturers have the main obligations, while importers and distributors must check that products they place or make available on the EU market comply. The CRA applies to products sold in the EU regardless of where the manufacturer is based. A US or UK company selling software in the EU is covered just like a German company.
Some products are excluded because they are already covered by specific EU sector legislation. These include medical devices, in vitro diagnostic medical devices, certain motor vehicle systems, civil aviation equipment and marine equipment. Open-source software developed outside a commercial activity is also treated differently, with a lighter regime for open-source software stewards.
2. What does the CRA require?
The CRA focuses on two main areas:
- how the product is designed and built;
- how its security is maintained throughout its lifecycle.
Security by design and by default
Annex I of the CRA sets the essential cybersecurity requirements that products must meet before they are placed on the market. Key requirements include:
- No known exploitable vulnerabilities. Products must be placed on the market without known exploitable vulnerabilities. This makes pre-release penetration testing and vulnerability assessments important parts of the development process.
- Secure default settings. Products must be secure out of the box. Users should not have to change basic settings to achieve an appropriate level of security.
- Protection of data and functions. Products must protect confidentiality, integrity and availability in proportion to the risks. This includes encrypting relevant data.
- Reduced attack surface. Products should expose only the interfaces and services they need.
Vulnerability handling throughout the product lifecycle
Manufacturers must have a documented process for handling vulnerabilities throughout the support period. This period is generally at least five years, unless the product’s expected lifetime is shorter. The process must cover identifying and fixing vulnerabilities, providing security updates, operating a coordinated vulnerability disclosure policy and publishing information about corrected issues.
This is a significant change for many product teams: security is no longer just a launch requirement. It must be maintained throughout the product’s supported life.
Reporting obligations: already applicable
Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents affecting their products. The process starts with an early warning within 24 hours. These reporting obligations apply before the CRA’s general application date, so companies need to prepare for them now.
3. CRA timeline: key dates to remember
The key dates are:
| Date | What applies |
|---|---|
| 10 December 2024 | The CRA entered into force |
| 11 June 2026 | Provisions on notified bodies apply, allowing conformity assessment capacity to be established |
| 11 September 2026 | Reporting obligations for actively exploited vulnerabilities and severe incidents apply |
| 11 December 2027 | The CRA applies generally, including its essential requirements and CE marking obligations |
December 2027 may seem far away. But for products with long hardware development cycles, certification lead times or several planned software releases, it is not. Products placed on the market from that date must comply. Security by design cannot simply be added at the last minute.
4. CE marking and conformity assessment
The CRA uses the EU’s existing product compliance framework. Products that comply must bear the CE marking, supported by a conformity assessment and technical documentation. The required assessment route depends on the product’s classification.
The product categories and their conformity routes are:
| Product class | Examples | Conformity route |
|---|---|---|
| Default category | Most products with digital elements | Manufacturer self-assessment |
| Important, Class I | Password managers, VPNs, smart home assistants, network interfaces | Harmonised standards, or third-party conformity assessment |
| Important, Class II | Firewalls, hypervisors, tamper-resistant microcontrollers | Third-party conformity assessment |
| Critical | Smart meter gateways, smart cards, secure elements | European cybersecurity certification, where required |
Consulting and conformity assessment are two different activities. Consultants can help companies improve product security, prepare documentation, establish vulnerability-handling processes and test products. Where the CRA requires third-party assessment, this must be carried out by an appropriately designated notified body. The roles must remain independent and impartial.
5. Penalties for non-compliance and how to prepare
Under the CRA, failure to meet the essential cybersecurity requirements can result in administrative fines of up to €15 million or 2.5% of the company’s total worldwide annual turnover for the preceding financial year, whichever is higher. Market surveillance authorities may also restrict or withdraw non-compliant products from the EU market.
For many manufacturers, the risk to market access may be more significant than the fine itself. Having a product withdrawn from the EU market during its lifecycle can have a direct impact on revenue.
Companies should treat CRA compliance as an ongoing programme, built into product releases, rather than a last-minute exercise in 2027. A practical approach includes:
- Review your product portfolio. List all products with digital elements that are sold in the EU. Check which CRA categories apply and identify the relevant conformity assessment route.
- Assess gaps against Annex I. Compare current security practices with the essential requirements, including secure defaults, update mechanisms, data protection and attack-surface reduction.
- Set up vulnerability handling. Establish a disclosure policy, a process for receiving reports, remediation workflows and an update process that covers the full support period.
- Prepare for reporting. The 24-hour reporting timeline is already applicable. Define who identifies an issue, who assesses it and who submits the notification.
- Test before declaring conformity. Independent penetration testing of the product and its update mechanisms can help identify weaknesses that an internal review may miss.
- Build the technical documentation as you go. Keep the documentation supporting the CE marking up to date with each product release. This is much easier than trying to assemble it all at once.
6. How CertX / SGS can help
CertX / SGS can support manufacturers throughout their CRA compliance journey:
Awareness & Education
UNDERSTAND THE REGULATION
Build internal awareness and give teams the knowledge they need to understand and address CRA requirements.
- Tailored CRA training for management and technical teams
- Awareness sessions for R&D, engineering and quality teams
- Targeted regulatory workshops and practical use cases
- Clear explanation of CRA obligations, scope and implementation timeline
Value delivered: Help key stakeholders understand their responsibilities and what the CRA means for their products and processes.
Consulting & Testing
IMPLEMENT THE REQUIREMENTS
Turn regulatory requirements into practical cybersecurity measures and clear compliance plans.
- CRA compliance roadmap and strategic advisory
- Cybersecurity risk assessments
- CRA gap analysis covering product design, technical documentation and processes
- Cybersecurity architecture and security measure design
- SBOM and third-party component analysis
- Supplier cybersecurity due diligence
- Vulnerability assessments and penetration testing
Value delivered: Identify compliance gaps, reduce cybersecurity risks and help implement the required technical and organisational measures.
Compliance & Certification
DEMONSTRATE CONFORMITY
Provide independent assessment and conformity evaluation to support regulatory compliance and access to the EU market.
- Technical documentation and technical file assessment
- Conformity assessment for products with digital elements
- Notified Body services for applicable product categories (Important and Critical Classes)
- Product conformity assessment
- Independent verification of cybersecurity requirements
Value delivered: Provide confidence in product conformity, support CE marking and help manufacturers access the European market.