EU Cyber Resilience Act
The first EU-wide horizontal regulation mandating cybersecurity requirements for all hardware and software products with digital elements -- from smart lightbulbs to enterprise operating systems -- throughout their entire lifecycle, with CE marking, SBOM obligations, and vulnerability reporting to ENISA.
Every connected product sold in Europe -- whether it is a baby monitor, a fitness tracker, a router, or an accounting software package -- must meet a baseline of cybersecurity rules before it can carry a CE mark. That is the core idea behind the Cyber Resilience Act, formally Regulation (EU) 2024/2847, which entered into force on 10 December 2024.
Until the CRA, the EU had no single law requiring manufacturers of digital products to build security in from the start and keep their products patched over time. Individual sectors had their own rules, but a cheap smart plug and a complex enterprise firewall faced the same legal vacuum. The CRA closes that gap: if your product connects to a network or to another device, you must design it securely, fix vulnerabilities when they appear, and tell ENISA quickly when something goes wrong.
The regulation does not treat every product equally. A word processor is less risky than an operating system used in hospitals, so the CRA sorts products into four categories -- from "default" (self-assessment is enough) up to "critical" (you need an EU cybersecurity certification scheme). Roughly 90% of products in scope fall in the lightest category, but the higher you go, the more an independent body must verify your work.
Companies have until December 2027 to reach full compliance, but mandatory vulnerability reporting to ENISA kicks in by September 2026. The penalties are substantial -- up to EUR 15 million or 2.5% of worldwide annual turnover for essential requirement violations -- so early preparation matters. The sections below break down every requirement, timeline, and assessment path in detail.
The CRA classifies products into four risk-based categories, each with different conformity assessment requirements. Higher risk means stricter third-party oversight.
The vast majority of products with digital elements. Manufacturers may self-assess conformity using internal control procedures. Estimated to cover ~90% of products in scope.
When a manufacturer becomes aware of an actively exploited vulnerability, a strict reporting timeline applies. ENISA operates a single reporting platform to streamline notifications across all Member States.
The CRA is the first EU regulation to mandate SBOM as part of technical documentation. Manufacturers must identify and document all software components in their products.
The assessment path depends on the product classification. Higher-risk products require greater involvement from notified bodies.
The CRA assigns different obligations depending on your role in the supply chain. Select a role to filter, or view all obligations side by side.
| OBLIGATION | MFR | IMP | DIST |
|---|---|---|---|
| Ensure product meets essential cybersecurity requirements | ✓ | ✓ | — |
| Conduct cybersecurity risk assessment | ✓ | — | — |
| Prepare technical documentation (incl. SBOM) | ✓ | — | — |
| Perform conformity assessment | ✓ | — | — |
| Draw up EU declaration of conformity | ✓ | — | — |
| Affix CE marking | ✓ | — | — |
| Verify CE marking and documentation exist | — | ✓ | ✓ |
| Handle and report vulnerabilities to ENISA | ✓ | — | — |
| Provide security updates (min. 5 years) | ✓ | — | — |
| Inform manufacturer of discovered vulnerabilities | — | ✓ | ✓ |
| Ensure proper storage/transport conditions | — | ✓ | ✓ |
| Cooperate with market surveillance authorities | ✓ | ✓ | ✓ |
| Include name and contact info on product/packaging | ✓ | ✓ | — |
| Withdraw non-compliant products from market | ✓ | ✓ | ✓ |
The CRA uses a phased rollout. Companies have until December 2027 for full compliance, but vulnerability reporting starts in September 2026.
The CRA sits within a complex web of EU digital legislation. Understanding overlaps and demarcations is critical to avoid double compliance and exploit synergies.
Select your company type for tailored compliance guidance.