How to Comply with the EU Cyber Resilience Act: Authorised Representatives and Key Business Duties

The European Union’s Cyber Resilience Act (CRA) is set to introduce stricter cybersecurity requirements for digital products. While the regulation officially came into force on December 10, 2024, businesses will have until December 11, 2027, to fully comply with its provisions.

What the CRA Regulates

The CRA applies to a broad range of digital products, including software and hardware that connect to networks or other devices. Everyday consumer electronics such as smart home systems, wearable technology, and industrial equipment will fall under its scope. However, products already regulated under other EU laws—such as medical and automotive devices—are exempt.

The primary objective of the law is to minimize cybersecurity risks by ensuring that manufacturers implement security features at the design stage and continue to support their products with necessary updates. This will help reduce vulnerabilities and protect users from cyber threats.

Manufacturer’s Support Obligations

Support for a product is one of the CRA’s operationally significant requirements.

The CRA sets a minimum five-year support period during which the manufacturer must handle vulnerabilities, unless the product is expected to be in use for less than five years. Security updates must remain available for at least 10 years (or the remainder of the support period, whichever is longer), and the end date of the support period must be communicated to the customer at point of sale. 

Who Needs to Take Action?

The CRA introduces new obligations for several stakeholders in the supply chain:

• Manufacturers must develop products with built-in security measures, ensure they are free of known vulnerabilities at launch, and provide security updates throughout the product’s lifespan. Any identified weaknesses must be reported and addressed.
• Importers and Distributors are responsible for ensuring that all digital products meet the CRA’s cybersecurity requirements before they enter the European market. Products must also display the CE marking to indicate compliance.
• Consumers will benefit from increased transparency regarding cybersecurity protections, making it easier to choose safer digital products.

Important Information about Authorised Representatives and Digital Products

For physical products, the Authorised Representative’s name and address must typically be included on the product, its packaging, or in an accompanying document. However, for digital-only products such as software or apps, the rules are adapted. In these cases, the Authorised Representative’s details must be made easily accessible in digital form—this could be through the app’s settings, the “About” or legal information section, within the digital download interface, or in accompanying documentation such as a digital user manual or EULA. The key requirement is that the information is visible, easily retrievable, and clearly linked to the product, allowing the authorities to trace and contact the manufacturers of non-compliant products.

Non-EU manufacturers may appoint, by written mandate, an Authorised Representative established in the Union. The AR keeps the EU declaration of conformity and the technical documentation available for market surveillance authorities for at least 10 years (or the support period, whichever is longer), responds to reasoned requests, and cooperates on corrective action — but the AR is not responsible for design, conformity assessment, vulnerability handling, or reporting.

How Can Businesses Prepare for Compliance?

To ensure compliance with the CRA, businesses should begin by conducting a thorough cybersecurity risk assessment across their digital product range. This includes reviewing product design, identifying potential vulnerabilities, and ensuring secure default configurations. Implementing a process for regular security updates and clear incident reporting are also essential. Companies should train relevant staff on CRA requirements, consider using cybersecurity standards (such as ISO/IEC 27001), and maintain detailed technical documentation. Appointing a dedicated compliance team or external consultant can also help navigate the complexities of the regulation.

Important Dates for Cyber Resilience Act

Date	Requirement
20 November 2024	CRA published in the Official Journal of the EU
10 December 2024	CRA entered into force
11 June 2026	Rules relating to conformity assessment bodies begin to apply
11 September 2026	Vulnerability and incident reporting obligations apply
11 December 2027	Full CRA compliance required

Non-compliance could result in severe financial penalties, with fines reaching up to €15 million or 2.5% of a company’s global annual turnover.

With the deadline approaching, businesses dealing with digital products must act now to align with the CRA’s cybersecurity requirements, ensuring both legal compliance and enhanced security for users.

Read our Cyber Resilience Act (CRA) FAQs

We now provide CRA Consultancy Services, get in contact today to find out more or read more about our CRA services and all our product compliance consultancy services at Product Compliance Support.