The EU Cyber Resilience Act: what manufacturers have to do.
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, makes cybersecurity a condition for the CE marking of hardware and software with a data connection.This guide covers who the regulation applies to, what it requires of manufacturers and how compliance works in practice, step by step.
Last reviewed:
The Cyber Resilience Act will ensure that connected products placed on the European market are secure by design.
What is the Cyber Resilience Act?
The Cyber Resilience Act, Regulation (EU) 2024/2847, is the EU regulation setting cybersecurity requirements for products with digital elements: hardware and software with a data connection made available on the EU market. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026; the remaining obligations apply from 11 December 2027.
Its official short title is the Cyber Resilience Act; the German text calls it Cyberresilienz-Verordnung. Product teams usually say EU CRA. All terms in the EU CRA glossary →
Why does the EU regulate product cybersecurity?
Before the Cyber Resilience Act, EU law set no horizontal mandatory cybersecurity requirements for products with digital elements (recital 3). The regulation closes that gap with one set of horizontal rules for every product with digital elements, from design through the end of its support period.
Two major problems adding costs for users and society should be addressed: a low level of cybersecurity of products with digital elements, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and an insufficient understanding and access to information by users.
Global Impact
€5.5 Trillion
Estimated global annual cost of cybercrime in 2021, as cited in the Commission proposal for the Cyber Resilience Act (COM(2022) 454).
Who has to comply with the Cyber Resilience Act?
The EU Cyber Resilience Act applies to every economic operator that makes products with digital elements available on the EU market, regardless of company size or where the company is based. Manufacturers carry the main obligations (Art. 13 and 14); importers and distributors check before they sell (Art. 19 and 20).
The chain of responsibility
- 1
Manufacturers
Develop products, or have them developed, and market them under their own name or trademark (Art. 3(13)). They carry risk assessment, vulnerability handling, reporting and conformity assessment.
- 2
Importers
Place products of non-EU manufacturers on the EU market and verify beforehand that conformity assessment, documentation and CE marking are in place (Art. 19).
- 3
Distributors
Check CE marking and accompanying information before making a product available, and act when they learn of non-compliance (Art. 20).
Compliance Assessment
Conformity assessment
A product's class sets its conformity assessment route. Products not listed in Annex III or IV may be self-assessed by the manufacturer, and that covers most machinery, appliances and building technology. Important and critical products follow stricter procedures under Art. 32.
Annex III: important products, Class I and IIModule A
Self-assessment
Default class (Art. 32(1))
Annex III/IV
Stricter procedures
Important and critical products (Art. 32(2) to (4))
Are You Affected by the CRA?
Take this quick assessment to find out if your product requires CRA compliance
Requirements
What does the Cyber Resilience Act require of manufacturers?
Annex I sets the essential requirements in two parts: properties of the product (Part I) and vulnerability handling (Part II). Articles 13 and 14 add the manufacturer's duties around them.
Security by design and by default
Products are designed based on a risk assessment, shipped without known exploitable vulnerabilities and with a secure default configuration (Art. 13(2), Annex I Part I).
Vulnerability handling
Throughout the support period, which reflects the expected time in use and is generally at least five years (Art. 13(8)), vulnerabilities are fixed without delay and security updates are free.
24-hour early warning
Actively exploited vulnerabilities and severe incidents go to the coordinating CSIRT and ENISA within 24 hours of awareness, followed by a notification within 72 hours (Art. 14).
SBOM and technical documentation
A software bill of materials covering at least top-level dependencies (Annex I Part II(1)) and technical documentation under Annex VII, kept for at least ten years (Art. 13(13)).
Conformity assessment and CE marking
Before a product is placed on the market, the manufacturer completes conformity assessment under Art. 32, draws up the EU declaration of conformity and affixes the CE marking.
Protection against unauthorised access
Authentication and access control mechanisms protect the product, and the confidentiality and integrity of its data are safeguarded (Annex I Part I(2)(d) to (f)).
Implementation
How do manufacturers implement the Cyber Resilience Act?
Implementing the EU Cyber Resilience Act runs product by product. Six steps lead from the portfolio list to the CE marking, and the last one stays open for the whole support period.
- 01
Check which products are in scope
List every product with a data connection, including service ports and companion apps (Art. 2(1) EU CRA).
Sectors and product finder - 02
Determine the class
Match each product's core function against Annex III and IV (Art. 7(1)). Most products are not listed there and stay in the default class; the class sets the conformity route.
Class by product - 03
Assess risks and gaps
Carry out the cybersecurity risk assessment (Art. 13(2)) and compare the product against Annex I.
Free EU CRA assessment - 04
Set up SBOM, vulnerability handling and reporting
Keep an SBOM per release, a disclosure policy and a reporting route that meets the 24-hour deadline (Annex I Part II, Art. 14).
Reporting obligations under Art. 14 - 05
Document, assess, declare
Technical documentation under Annex VII, conformity assessment under Art. 32, EU declaration of conformity and CE marking.
Conformity assessment and CE marking - 06
Maintain it for the support period
State the end of support at purchase (Art. 13(19)), keep monitoring components and keep the documentation current.
EU CRA compliance software
Across a portfolio, these steps turn into recurring work per product and release. Kunnus brings classification, SBOMs, vulnerabilities, reporting and technical documentation together in one place.
What EU CRA compliance software has to coverSMEs in the EU can apply until 11 December 2026 for a 50 % grant of up to €30,000 for an EU CRA project from the SECURE programme.
SECURE fundingTimeline
Which Cyber Resilience Act deadlines apply?
10 December 2024
Entry into force of Regulation (EU) 2024/2847 (Art. 71(1)).
11 June 2026
Rules on notifying authorities and notified bodies (Chapter IV) apply.
11 September 2026
Reporting obligations under Art. 14, also for products already on the market (Art. 69(3)).
11 December 2027
Full application: every product placed on the EU market has to meet all requirements.
Cyber Resilience Act: current status — which deadline comes next?
Enforcement
What fines does the Cyber Resilience Act set?
Breaching Annex I or the duties in Articles 13 and 14 can cost up to €15 million or 2.5 % of worldwide annual turnover, whichever is higher (Art. 64(2)). Several other obligations carry up to €10 million or 2 % (Art. 64(3)), and incorrect or misleading information to authorities up to €5 million or 1 % (Art. 64(4)). Penalties under the Cyber Resilience Act in detail →
Of total worldwide annual turnover
Whichever is higher
Penalties are enforced at the national level
EU member states have the authority to impose these fines for non-compliance with the Cyber Resilience Act requirements.
SME Relief
What relief do smaller manufacturers get?
The EU Cyber Resilience Act explicitly accounts for the reality of smaller companies. Article 3(19) and Recital 5 establish targeted relief measures — but they are not distributed equally across all SME categories.
Micro & Small Enterprises(< 50 employees)
- Fine exemption for late 24h early warnings
- Simplified technical documentation format
- Dedicated implementation helpdesks
- Priority access to regulatory sandboxes
- Reduced conformity assessment fees
Medium Enterprises(< 250 employees)
- Reduced conformity assessment fees
- CSIRT helpdesk for reporting obligations
- Enterprise size as mitigating factor in fines
No fine exemption, no simplified documentation, no dedicated helpdesks, no priority sandbox access.
Important: These measures reduce the procedural burden, not the cybersecurity standard itself. All Annex I requirements apply regardless of size.
Is your sector affected?
The Cyber Resilience Act covers products from industrial machinery and IoT to software and smart home. The sector pages show which class typical products fall into and which obligations weigh most.
FAQ
Frequently asked questions
Common questions about the EU Cyber Resilience Act
Next steps: from knowledge to implementation
The EU Cyber Resilience Act makes cybersecurity requirements a precondition for the CE marking of products with digital elements (Art. 30). It covers hardware with embedded software, such as industrial controllers, IoT devices and network equipment, standalone software such as desktop and mobile applications, and the remote data processing a product needs for its functions. Key requirements include a risk assessment during design, secure default configurations, a software bill of materials, coordinated vulnerability disclosure, free security updates for the support period (generally at least five years, or the shorter expected use time; Art. 13(8)) and reporting of actively exploited vulnerabilities to the coordinating CSIRT and ENISA within 24 hours (Art. 14). Products fall into the default class, important Class I or Class II (Annex III) or critical (Annex IV); the higher classes need stricter conformity assessment. The EU CRA entered into force on 10 December 2024; reporting obligations have applied since 11 September 2026, and full application follows on 11 December 2027.
How ready is your company for the EU CRA?
Our free readiness assessment shows you in 15 minutes where your organization stands and what to do next.
Official Sources
Regulation (EU) 2024/2847 — Cyber Resilience Act — Official Journal of the European Union
ENISA — European Union Agency for Cybersecurity — Responsible for CRA vulnerability reporting
European Commission — CRA Overview — Official CRA information page by the European Commission
CRA updates by email
Deadlines, official guidance and myth-busting fact-checks on the EU Cyber Resilience Act, compact in our newsletter.
Where does your product stand on the Cyber Resilience Act?
The free maturity assessment shows what is still missing for your portfolio. Kunnus then keeps classification, SBOMs, vulnerabilities, reporting and technical documentation per product.