FAQ: Cyber Resilience Act (CRA)

The Cyber Resilience Act (CRA) is new EU legislation aimed at ensuring that products with digital elements — such as software, smart devices, and connected hardware — meet essential cybersecurity requirements throughout their lifecycle. It establishes baseline obligations for manufacturers, importers, and distributors to protect users against cyber risks.

The CRA applies to any business placing digital products on the EU market, whether they are manufactured inside or outside the EU. This includes software publishers, hardware manufacturers, authorised representatives, and importers. If your product has a digital component (e.g., software, connectivity, data processing), the CRA is likely relevant.

The CRA entered into force in January 2024. The main obligations are expected to apply after a 36-month transition period, meaning businesses must comply by 2027. Certain reporting obligations for vulnerabilities will apply earlier.

CRA Timeline: Key Milestones & Deadlines
15 September 2022
European Commission proposal – The initial legislative proposal for the CRA is published.
1 December 2023
Political agreement reached – EU institutions agree on a compromise text.
March 2024
European Parliament approval – Parliament formally adopts the CRA text.
10 October 2024
Council adoption – The Council adopts the regulation.
20 November 2024
Publication in Official Journal – The CRA is published in the EU Official Journal as Regulation (EU) 2024/2847.
10 December 2024
Entry into force – The CRA becomes law (i.e. “enters into force”) across the EU legal order.
11 June 2026
Conformity assessment body provisions apply – Rules relating to the designation and operation of conformity assessment bodies begin to apply, helping prepare the framework for product certification and compliance assessments.
11 September 2026
Vulnerability & incident reporting obligations kick in – From this date, manufacturers must comply with CRA rules on reporting actively exploited vulnerabilities and serious cybersecurity incidents.
11 December 2027
Full application / compliance deadline – All remaining CRA obligations become fully enforceable, including cybersecurity requirements, conformity assessments, technical documentation, CE marking obligations, and security update requirements.tc.) become fully enforceable.

The CRA covers products with digital elements, which includes:
Consumer and industrial connected devices (IoT, smart appliances, wearables)
Software and operating systems
Networking equipment and infrastructure
Products that rely on data processing or connectivity
Critical products (like identity management systems, firewalls, and industrial control systems) will face stricter conformity assessment rules.

Manufacturers and economic operators will need to:
Design and develop products in line with essential cybersecurity requirements
Ensure vulnerabilities are addressed through updates for the expected product lifetime or at least 5 years
Report actively exploited vulnerabilities and incidents to the European Cybersecurity Agency, ENISA, within tight deadlines
Conduct conformity assessments and issue EU declarations of conformity
Provide clear cybersecurity instructions for users

Businesses placing products with digital elements on the EU market will need to build cybersecurity into design, production, and maintenance. Compliance may require new risk management processes, product testing, supply chain checks, and ongoing monitoring of vulnerabilities.

Failure to comply with the CRA can result in significant penalties, including fines of up to €15 million or 2.5% of global annual turnover (whichever is higher). Products may also be withdrawn from the EU market if found non-compliant.