EU CRA glossary: Cyber Resilience Act terms
Last reviewed:
What do the key Cyber Resilience Act terms mean?
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, defines its terms in Art. 3. The ones manufacturers need most are product with digital elements, manufacturer, placing on the market, substantial modification, support period and actively exploited vulnerability. This glossary explains each briefly, with its legal reference and a link to go deeper.
Main page: the Cyber Resilience Act explained →What else is the Cyber Resilience Act called?
- Cyber Resilience Act (EU CRA)
- Short title of the EU regulation on horizontal cybersecurity requirements for products with digital elements. This site abbreviates it as EU CRA so it is not confused with other uses of the same acronym.
- Regulation (EU) 2024/2847More on this: The Cyber Resilience Act explained →
- Cyberresilienz-Verordnung
- Also: Cyber-Resilienz-Verordnung
- The official German short title of the Cyber Resilience Act, as printed in the German edition of the Official Journal. German speakers also write it with two hyphens.
- Title of Regulation (EU) 2024/2847More on this: The Cyber Resilience Act explained →
- Cyberresilienzgesetz
- Also: Cyber-Resilienz-Gesetz, Cyber Resilience Law
- An informal German name for the Cyber Resilience Act. Strictly speaking it is not a national law but an EU regulation, which applies directly in every member state without transposition.
- Art. 288 TFEUMore on this: The Cyber Resilience Act explained →
- Regulation (EU) 2024/2847
- The official reference of the Cyber Resilience Act. The knowledge base carries the full text with articles, recitals and annexes.
- Official Journal of the EU, L seriesMore on this: The regulation in the knowledge base →
Which terms decide whether a product is in scope?
- Product with digital elements
- A software or hardware product and its remote data processing solutions, including components placed on the market separately. It falls under the EU Cyber Resilience Act when its use includes a direct or indirect data connection to a device or network (Art. 2(1)).
- Art. 3(1) EU CRAMore on this: Cyber Resilience Act scope →
- Logical, physical and indirect connection
- A logical connection runs through a software interface; a physical one through electrical, optical or mechanical interfaces, wires or radio waves. A product is indirectly connected when it reaches a network as part of a larger system.
- Art. 3(8) to (10) EU CRAMore on this: Why a single USB port brings offline devices into scope →
- Remote data processing
- Data processing at a distance whose software the manufacturer designed and developed, or had developed, and without which the product could not perform one of its functions. It is part of the product.
- Art. 3(2) EU CRAMore on this: The Cyber Resilience Act and SaaS →
- Component
- Software or hardware intended for integration into an electronic information system. When its maker places it on the market separately, it is a product with digital elements in its own right.
- Art. 3(6) EU CRAMore on this: Industrial components and suppliers →
- Important and critical products
- Products whose core functionality matches a category in Annex III (important, Class I or II) or Annex IV (critical). They follow stricter conformity assessment than the default class.
- Art. 7 and 8, Annex III and IV EU CRAMore on this: Annex III: important products →
Who is who in the supply chain?
- Manufacturer
- Anyone who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under their own name or trademark, including free of charge.
- Art. 3(13) EU CRAMore on this: Why your logo makes you the manufacturer →
- Importer
- A person established in the EU who places a product bearing the name or trademark of a non-EU manufacturer on the EU market. The importer first ensures that the manufacturer has carried out conformity assessment, drawn up the documentation and affixed the CE marking.
- Art. 3(16) and Art. 19 EU CRA
- Distributor
- Anyone in the supply chain, other than the manufacturer or importer, who makes a product available on the EU market without changing its properties.
- Art. 3(17) and Art. 20 EU CRA
- Authorised representative
- A person in the EU whom a manufacturer may mandate in writing to carry out specified tasks, such as keeping documents available for market surveillance. Appointing one is optional.
- Art. 3(15) and Art. 18 EU CRAMore on this: The Cyber Resilience Act for Swiss manufacturers →
- Open-source software steward
- A legal person, not a manufacturer, that supports the development of free and open-source software intended for commercial activities on a sustained basis. Stewards have lighter obligations.
- Art. 3(14) and Art. 24 EU CRA
Which terms belong to conformity and CE marking?
- Placing on the market
- The first making available of a product on the EU market. Under the EU Blue Guide (section 2.3) it counts per individual unit, so a device taken from stock can be placed on the market later than identical ones.
- Art. 3(21) EU CRA; Blue Guide section 2.3
- Substantial modification
- A change after placing on the market that affects compliance with the requirements in Annex I Part I or modifies the intended purpose. It can bring a product already on the market under the EU CRA.
- Art. 3(30) and Art. 69(2) EU CRAMore on this: When the EU CRA applies to existing products →
- Conformity assessment
- The process that shows whether a product meets the essential requirements of Annex I. Which procedure applies depends on the product class.
- Art. 3(27) and Art. 32 EU CRAMore on this: Conformity assessment step by step →
- Notified body
- A conformity assessment body that a member state has notified under the EU CRA. It assesses products for which the manufacturer chooses or needs a third-party procedure, such as important products without a fully applied harmonised standard.
- Art. 3(29) EU CRA
- Harmonised standard
- A European standard adopted on a request from the Commission. Once its reference is published in the Official Journal, it gives a presumption of conformity for the requirements it covers.
- Art. 3(36) and Art. 27(1) EU CRA
- CE marking for software
- For software, the manufacturer affixes the CE marking either to the EU declaration of conformity or on the website accompanying the software product. That section of the website must be easy and direct for consumers to reach.
- Art. 30(1) EU CRAMore on this: EU CRA and CE marking compared →
- Support period
- The period during which the manufacturer has to handle the product's vulnerabilities effectively. It reflects the expected time in use and is generally at least five years.
- Art. 3(20) and Art. 13(8) EU CRA
Which terms belong to vulnerabilities and reporting?
- Software bill of materials (SBOM)
- A formal record of the software components in a product and their dependencies. The EU CRA requires it in a commonly used machine-readable format, covering at least top-level dependencies.
- Art. 3(39), Annex I Part II(1) EU CRAMore on this: Generate an SBOM with kunnus-scanner →
- Actively exploited vulnerability
- A vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. It has to be reported within 24 hours of awareness.
- Art. 3(42) and Art. 14 EU CRAMore on this: Reporting obligations under Art. 14 →
- Severe incident
- An incident that affects the security of a product and endangers the protection of sensitive data or important functions, or introduces malicious code. It has to be reported as well.
- Art. 14(3) and (5) EU CRA
- CSIRT designated as coordinator
- The computer security incident response team a member state has designated to receive EU CRA notifications. Reports go through the single reporting platform to this CSIRT and to ENISA at the same time.
- Art. 3(51), Art. 14 and 16 EU CRA
Frequently asked questions about the terms
Is the Cyber Resilience Act a directive or a regulation?+
The Cyber Resilience Act is a regulation, Regulation (EU) 2024/2847. It applies directly in every EU member state, without national transposition. National rules only add points such as market surveillance arrangements and penalties.
What are products with digital elements?+
Products with digital elements are software and hardware products together with their remote data processing, including components sold separately (Art. 3(1) of the Cyber Resilience Act). They fall under the regulation when their use includes a direct or indirect data connection to a device or network.
Does software need a CE marking?+
Software placed on the market as a product with digital elements needs a CE marking once the EU Cyber Resilience Act applies in full. Under Art. 30(1), it goes on the EU declaration of conformity or on the website accompanying the software product.
What is the difference between placing on the market and making available?+
Placing on the market is the first making available of a product on the EU market (Art. 3(21) of the Cyber Resilience Act). Making available covers every supply in the course of a commercial activity, including each later one by distributors (Art. 3(22)). Many manufacturer obligations attach to placing on the market.
Where can I read Regulation (EU) 2024/2847?+
The official text is on EUR-Lex. The Kunnus knowledge base carries every article, recital and annex of the Cyber Resilience Act with cross-references and the interpretation from the EU Commission guidance.
The definitions paraphrase the regulation and do not replace it. The version published in the Official Journal of the EU is authoritative.