The substantial majority of the provisions of the Cyber Resilience Act (CRA) will apply only from 11 December 2027. However, economic operators cannot afford to wait until the last moment. The EU regulation introduces obligations that already apply and require manufacturers of digital products to put in place appropriate procedures, processes and tools for managing cybersecurity. The most significant change occurred on 11 September 2026, when the requirements concerning the reporting of actively exploited vulnerabilities and severe security incidents began to apply. The CRA may also affect businesses established outside the European Union if they place products with digital elements on the EU market. Companies operating internationally should therefore assess whether thesefall within the scope of the Regulation, identify the obligations applicable to their role in the supply chain and ensure that their internal cybersecurity and reporting procedures meet the relevant requirements.
1. What is the CRA?
The Cyber Resilience Act (CRA), formally Regulation (EU) 2024/2847, is an EU regulation establishinguniform cybersecurity requirements for products with digital elements. It covers both hardware devices and software, as well as certain services related to their functioning. The purpose of these provisions is to enhance resilience to cyber threats by ensuring an appropriate level of security throughout the product life cycle, from design and development, through production, to maintenance and updates.
The CRA may apply to businesses established both within and outside the European Union. In particular, non-EU manufacturers placing products with digital elements on the EU market should assess whether these fall within the scope of the Regulation and which obligations they must meet. The specific requirements depend on the nature of the product and the economic operator’s role, for example as a manufacturer, importer or distributor.
The Regulation may apply, among others, to:
- software manufacturers;
- mobile application developers;
- software houses developing their own products;
- manufacturers of IoT devices;
- consumer electronics producers;
- suppliers of hardware and software components;
- industrial undertakings using smart systems and devices.
Being active in one of these sectors does not automatically mean that every CRA requirement applies. The scope of the obligations must be assessed based on the product concerned, any relevant exclusions and the company’s role in the supply chain.
2. Which obligations apply as of today?
Although most of the CRA’s product cybersecurity requirements will apply from 11 December 2027, the first obligations have applied since 11 September 2026. They relate primarily to the reporting of vulnerabilities and security incidents associated with products with digital elements. This means that manufacturers must have procedures in place to detect threats promptly, assess their impact on product security and submit the required notifications to the competent authorities within the prescribed time limits. These reporting obligations may also affect manufacturers established outside the European Union whose products fall within the scope of the CRA. Companies operating internationally should ensure that their internal processes cover the relevant teams and supply chain partners.
- Reporting of actively exploited vulnerabilities – the manufacturer must notify the competent authorities within 24 hours of becoming aware of the threat; a full notification must follow within 72 hours. A final report must be submitted no later than 14 days after a corrective or mitigating measure has been made available.
- Reporting of severe security incidents – an early warning must be submitted within 24 hours, followed by notification to ENISA and to the competent CSIRTs within 72 hours of the detecting the incident.
- Submissions through the Single Reporting Platform – all notifications are submitted through the SRP operated by ENISA and the information is forwarded to the competent Computer Security Incident Response Team (CSIRT).
3.Obligations that will apply from 11 December 2027
The most far-reaching changes for manufacturers of digital products will apply from 11 December 2027, whenthe majority of the CRA requirements take full effect. Business will then need not only to respond to threats but, above all, to demonstrate that cybersecurity has been taken into account at every stage of the product life cycle.
1) Design principles (security by design / by default) – digital products placed on the EU market must be secure from the design stage and delivered with secure default settings.
2) Vulnerability management throughout the life cycle – manufacturers will be obliged to monitor threats and provide security support throughout the product’s declared support period.
3) Technical documentation and conformity assessment – before placing a product on the market, it will be necessary to prepare technical documentation demonstrating conformity with the CRA. For certain categories of products, the involvement of a notified body in the assessment procedure may also be required.
4) Software Bill of Materials (SBOM) – undertakings will be required to draw up and maintain an up to date inventory of the software components used in the product. The purpose of this requirement is to facilitate the identification of vulnerabilities and risk management throughout the supply chain.
5) Responsibility across the supply chain – the new obligations will extend not only to manufacturers but also to importers and distributors. Each operator in the supply chain will be required, according to its role, to ensure that the product complies with the CRA.
6) Financial penalties – non-compliance withthe CRA may result in severe financial sanctions. The maximum administrative fines may amount to EUR 15 million or 2.5% of the undertaking’s total worldwide annual turnover, whichever is higher.
4.How should undertakings prepare for the changes?
It is advisable to begin preparing for compliance with the CRA as early as possible. First, economic operators should determine whether their products fall within the scope of the new rules and what role they play in the supply chain. The next step is to carry out a gap analysis and a cybersecurity risk assessment to identify the necessary adjustment.
It is equally important to review the processes for detecting vulnerabilities, managing security updates and handling incidents. Undertakings should also put in place reporting procedures consistent with the requirements that have applied since September 2026. They will also need to organise their technical documentation and create or update the inventory of software components used in their products (SBOM).
Experts also highlight the need to review cooperation with suppliers and subcontractors, since the CRA applies not only to manufacturers but also to other entities in the supply chain.
In practice, preparation for the CRA should become a joint effort involving the IT, cybersecurity, compliance, procurement and legal departments. The earlier an organisation start, the easier it will be to meet the requirements applicable from 2027, reduce the risks of costly last minute adjustments and avoid substantial penalties for non-compliance. This is particularly important for businesses established outside the European Union, as the CRA may also apply to their products when placed on the EU market. Their planning should therefore account for the obligations arising from access to the market and ensure the measures needed to fulfil them.
Summary
The Cyber Resilience Act (CRA) introduces new cybersecurity requirements for digital products, includingsoftware, IoT devices and electronics. Since 11 September 2026, reporting obligations foractively exploited vulnerabilities and severe security incidents have applied. From 11 December 2027, the majority of the provisions will take effect, including those concerning secure product design, vulnerability management, technical documentation, SBOM and compliance across the supply chain. Business should therefore assess their obligations now, establish appropriate procedures and prepare for the remaining rules to reduce the risk of non-compliance and of substantial financial penalties. This is particularly relevant for companies established outside the European Union, as the CRA may also apply to products they place on the EU market. Their preparations should assess their obligations under the Regulation and take the necessary steps to ensure compliance with the applicable requirements.
