Does the Cyber Resilience Act (CRA) apply to me?

Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. It requires them to be designed securely, their vulnerabilities to be handled during the support period and actively exploited ones to be reported (Arts 6, 13 and 14; Annex I).

To products with digital elements made available on the EU market whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1)). The obligations fall on the manufacturer and also on importers and distributors (Arts 13, 19 and 20). There are exclusions, such as medical devices and vehicles (Art. 2).

It has been in force since 10 December 2024 and applies in phases (Art. 71): the rules on conformity assessment bodies from 11 June 2026; the reporting of actively exploited vulnerabilities and severe incidents from 11 September 2026; and the rest from 11 December 2027.

For a product to withstand attacks and recover from them with as little damage as possible. In the CRA it translates into design requirements (Annex I, Part I) and vulnerability handling during the support period (Annex I, Part II).

Since 11 September 2026, manufacturers must report the actively exploited vulnerabilities and the severe incidents that affect the security of their products, including products already on the market: an early warning within 24 hours and a notification within 72 hours of becoming aware, and a final report 14 days after a corrective or mitigating measure is available (vulnerabilities) or one month after the notification (severe incidents) (Arts 14 and 69(3)).

Software as a service on its own is outside. Remote data processing without which the product cannot perform one of its functions is part of the product, provided its software has been designed and developed by the manufacturer or under its responsibility (Art. 3(2)). A standard service from another provider is an external dependency of the product.

It is outside if it is not made available on the market in the course of a commercial activity. Examples of commercial activity include charging a price for the software, using it to monetise other products or services, or requiring personal data for reasons other than security, compatibility or interoperability (Art. 3(22) and Recitals 15 and 18). Open-source software stewards have their own lighter regime (Art. 24).

Products placed on the market before 11 December 2027 only become subject to the requirements if they are later substantially modified (Art. 69(2)). The reporting obligation of Art. 14 also applies to them (Art. 69(3)).

It depends on the category. By default, any procedure in Art. 32(1) is valid, including internal control. An important product of class I may use internal control only if it fully applies harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least ‘substantial’; otherwise it needs a notified body (Art. 32(2)). One of class II needs a notified body or a European cybersecurity certification scheme at assurance level at least ‘substantial’ (Art. 32(3)). A critical one needs a European certificate if a delegated act requires it; until there is one, the class II procedures apply (Art. 32(4)). Free and open-source software in an important category may use internal control if it makes the technical documentation public (Art. 32(5)).

• 20 October 2026 · version 2026.10.12-r6. First complete version: manufacturer, importer, distributor, tailor-made software, components, cloud linked to a product, free and open-source software and open-source software stewards; categories of Implementing Regulation (EU) 2025/2392; notification from 11 September 2026 and general application from 11 December 2027; corrigendum to Art. 64(10).