The Cyber Resilience Act (CRA) – what is it and who does it apply to?

If you manufacture, import or distribute network-connected devices or software on the EU market, the Cyber Resilience Act (CRA) will, in the coming years, directly change the way you design, place on the market and support your products. It is one of the most important EU regulations on cybersecurity in recent years, and its scope of impact is comparable to that of the GDPR – except that, rather than personal data, it focuses on the security of the digital product itself. It is worth bearing in mind that the CRA does not operate in a vacuum — it complements existing regulations on organisational cybersecurity, such as the NIS 2 Directive, which focuses on the security of companies and institutions, whilst the CRA relates to the security of the products themselves.

What is the Cyber Resilience Act?

The CRA is a European Union regulation which, for the first time, sets out cybersecurity requirements for products containing digital components in such a comprehensive manner. Unlike previous legislation, which focused mainly on data protection or the security of telecoms operators’ networks, the Cyber Resilience Act covers the product itself — from the design stage, through production, right through to its entire lifecycle on the market.

In practice, this concerns two main types of products:

• hardware with a digital component — routers, IP cameras, smart home appliances, IoT sensors, networking equipment,
• software — applications, operating systems, libraries and components that connect to a network or to other devices.

However, the Regulation does not cover everything without exception. Excluded from its scope are, amongst others, medical devices, vehicles, aviation equipment, military systems, as well as software offered exclusively as a service (SaaS) and open-source projects developed on a non-commercial basis — these areas are governed by separate sector-specific regulations.

What is the ‘security by design’ approach?

One of the cornerstones of the CRA is the principle of ‘security by design’. This means that a manufacturer cannot treat cybersecurity as an afterthought — it must be planned from the very first product sketch, taking into account the risks at every stage of the product lifecycle: design, manufacture, distribution and operation.

The four pillars of the Regulation

Although the CRA is a comprehensive piece of legislation, its requirements can be summarised in four main areas:

1. Security by design. Products must be designed to minimise the risk of vulnerabilities and incidents right from the concept stage, rather than only in response to a reported issue.
2. Vulnerability management and updates. The manufacturer is responsible for identifying and rectifying security vulnerabilities, and for providing free security updates throughout the product’s expected support period — as a rule, for no less than five years.
3. Documentation and transparency. Each product must be accompanied by technical documentation, and manufacturers are required to maintain a list of software components, known as an SBOM (Software Bill of Materials). This makes it easier for users and supervisory authorities to determine which components make up a given product and whether they contain any known vulnerabilities. Companies that have already implemented an information security management system, for example based on the ISO 27001 standard, generally find it easier to navigate these types of documentation requirements — we discussed how the two areas complement each other in our comparison of NIS2 and ISO 27001.
4. Incident reporting. Detected vulnerabilities that are being actively exploited, as well as serious security incidents, must be reported to the relevant authorities — within the European Union, the central reporting point is the platform operated by ENISA.

Once the security requirements have been met, the product is entitled to bear the CE marking, which in this context confirms compliance not only with mechanical or electrical requirements, but also with cybersecurity requirements.

When does the CRA come into force? Key dates

The CRA comes into force gradually, giving companies time to adapt their processes — but this also means that some obligations will come into effect sooner than one might think:

• 11 September 2026 — provisions on the reporting of actively exploited vulnerabilities and serious security incidents come into force,
• 11 December 2027 — almost all obligations imposed on manufacturers, importers and distributors placing products on the EU market will be fully in force.

This means that companies wishing to avoid last-minute implementation chaos should start analysing now whether their products fall within the scope of the regulation and what specific obligations they will have to fulfil.

What penalties apply for non-compliance with the CRA?

The scale of the sanctions provided for in the CRA is intended to effectively deter companies from taking their new obligations lightly. Breaches of the regulation’s provisions are punishable by financial penalties of up to €15 million or 2.5 per cent of the company’s total annual turnover — whichever is higher. This level is comparable to the penalties under the GDPR, which demonstrates how seriously the EU legislator takes the issue of digital product security. It is worth remembering, however, that the financial penalty itself is not the only cost of non-compliance — we described a similar mechanism, albeit in the context of ISO 27001, in the article ‘How much does the lack of ISO 27001 cost? A bill that makes an impression’ — the mechanism of hidden costs arising from a lack of security is very similar here.

What next?

If your company designs, manufactures or sells devices with a digital component or software on the EU market, it is worth answering two questions today: do your products fall under the CRA at all, and if so, which risk category do they fall into, as the scope of your obligations depends on this. In subsequent articles, we’ll break down the obligations of manufacturers under the CRA, as well as the process for reporting vulnerabilities and incidents.