Framework · Europe
Cyber Resilience Act
The Cyber Resilience Act sets cybersecurity requirements for products with digital elements. The reporting obligation has applied since 11 September 2026; the main obligations apply from 11 December 2027.
The framework explained
What does the CRA change for digital products?
What is it?
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for hardware and software with digital elements placed on the EU market. The requirements concern the product and the handling of vulnerabilities throughout the support period.
Who is it for?
The CRA applies to manufacturers, importers and distributors, with different obligations for each role. Whether a product is in scope depends on the product and how it connects to devices or networks; components sold separately may also be covered. Exceptions, open source and product-related remote data processing each need to be assessed separately.
Why take action?
The main obligations apply from 11 December 2027. Among other things, manufacturers must assess product risks, compile technical documentation and complete the applicable conformity assessment for the EU declaration of conformity and CE marking. This requires preparation in both development and maintenance.
Where do you start?
- List your products, components and your role in the supply chain.
- Build product-specific risk analysis, documentation and secure development and update processes.
- Set up your reporting procedure now: since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe product security incidents. An early warning is due within 24 hours of becoming aware, followed by a notification within 72 hours.
- Plan the conformity route and support period for each product ahead of December 2027.
Public sources · content checked on 5 October 2026
European Commission: the CRA and product obligations European Commission: reporting obligation and platform EUR-Lex: Regulation (EU) 2024/2847
Approach
Product-specific evidence
The CRA requires evidence at product and release level. An organisation-wide ISMS is not enough on its own.
- First, we identify your products and your role in the supply chain.
- Then we tailor the approach to those products.
- Our dedicated CRA offering is still being developed. In an introductory call, we look at your product context and suitable next steps.
Frameworks
Explore the other frameworks
Each framework has its own scope and evidence requirements. Often, several apply at once.
Want to discuss your products under the CRA?
Tell us which digital products you offer and what role you play in the supply chain. Together we look at the relevant questions and next steps.