CRA GUIDE

What is the Cyber Resilience Act (CRA)? A guide for device makers

By The Lapwing · Last updated

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is an EU law that makes cybersecurity mandatory for almost every product with digital elements — hardware and software — sold in the EU. If you make a connected device, you must build it securely, handle vulnerabilities for its support period and prove it with CE marking. Reporting duties already apply since 11 September 2026; the rest applies from 11 December 2027.

Not sure it applies to you? Take the free 2-minute scope check →

What does the CRA mean for a manufacturer?

Four obligations, spread over the whole product life cycle:

1 · Secure by design

13 essential requirements (Annex I, Part I): secure defaults, no known exploitable vulnerabilities at release, access control, encryption, signed updates, a small attack surface.

2 · Vulnerability handling

An SBOM, a coordinated disclosure policy, a public contact point and free security updates (Annex I, Part II) — for at least five years, unless the product is meant to be used for less.

3 · Proof

Cybersecurity risk assessment, technical documentation, EU declaration of conformity and CE marking. Keep the documentation for 10 years or the support period, whichever is longer.

4 · Reporting

Actively exploited vulnerabilities and severe incidents must be reported on a fixed clock (below).

Why was the CRA introduced?

Until now, no EU-wide rule made a connected product’s security the maker’s responsibility. Buyers cannot judge firmware quality, yet one weak device can open a whole network. The CRA moves that responsibility to the party that puts the product on the market, and ties market access to meeting it — the same logic as for electrical safety.

When does it apply?

  1. Entered into force
  2. Notified-body rules apply
  3. Reporting duties applyIn force today
  4. Everything else applies

The surprise for many manufacturers: the reporting duty is already live, and it covers products sold years ago (Art. 69 and 14). Your oldest shipped product can trigger it tomorrow.

What must I report, and how fast?

  1. 24 hEarly warning
  2. 72 hNotification with details
  3. 14 days / 1 monthFinal report

The clock starts when you become aware of an actively exploited vulnerability or a severe incident affecting security. Reports go to your designated national CSIRT and ENISA. The final report is due 14 days after a fix is available (vulnerability) or one month after the notification (incident). The hard part is not the form but having a named person and a rehearsed process that can act within 24 hours.

Who is responsible?

The manufacturer — whoever sells the product under their own name, even if a supplier wrote the firmware. Importers and distributors must verify that the manufacturer did its part. Open-source components you use are your due-diligence responsibility, too.

What happens if I ignore it?

Fines of up to €15 million or 2.5% of worldwide annual turnover for breaking the essential requirements or the manufacturer and reporting duties (up to €10 million / 2% for other obligations). In practice the bigger risk is being forced to withdraw a product from the EU market.

Where should I start?

  1. Check scope and class — take the 2-minute scope check or read about product classes.
  2. Name your 24-hour owner for vulnerability and incident reports.
  3. Start an SBOM and a disclosure policy with a public contact address.
  4. Run a gap assessment against the 13 requirements, product by product.

Frequently asked questions

Does the CRA apply to products already on the market?

The full requirements apply to products placed on the market from 11 December 2027, and to earlier products only after a substantial modification. The reporting duty for actively exploited vulnerabilities and severe incidents (Art. 14) already applies to products placed on the market before that date.

Do I need an audit or certificate to comply?

Not for most products. Products in the default class are assessed by the manufacturer itself (internal control) and declared with CE marking. Only products on the Annex III and IV lists need stricter assessment by a third party or certification.

Does the CRA apply to manufacturers outside the EU?

Yes. It applies to products made available on the EU market, whatever the manufacturer's location. A non-EU manufacturer still carries the manufacturer duties, and importers and distributors have their own checks.

Is the CRA the same as NIS2?

No. NIS2 regulates the cybersecurity of organisations and services, the CRA regulates the security of products placed on the market. A company can be affected by both, in different roles.

Find out where your product stands

Two minutes, answers stay in your browser. You get a likely scope, product class and first steps — then decide if you want a deeper look.

Start the scope check →Request a Pilot

Read next: Is your product in scope of the CRA? Product classes explained →

General information based on Regulation (EU) 2024/2847, not legal advice. It does not certify or guarantee compliance of any product.