What Is the Cyber Resilience Act? A Plain-Language Introduction for Manufacturers
Updated 20 September 20263 min read
The Cyber Resilience Act, or CRA, is Regulation (EU) 2024/2847: the EU law that sets cybersecurity requirements for products with digital elements — hardware and software — sold in the European Union. If you make connected devices or software, it very likely applies to you.
The key dates
| Date | What happens |
|---|---|
| 20 November 2024 | Published in the Official Journal |
| 10 December 2024 | Entry into force |
| 11 June 2026 | The rules on conformity assessment bodies (Chapter IV) apply |
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents applies (Article 14) |
| 11 December 2027 | The rest of the Regulation applies, including the essential requirements and the fines |
Who it applies to
The products: a product with digital elements is a software or hardware product and its remote data processing solutions (Article 3). That covers connected devices, standalone software, and in some cases the cloud backend they depend on — see when the cloud is part of your product.
The companies: the obligations fall mainly on manufacturers, with duties for importers and distributors too.
The exclusions: products covered by their own sector rules, such as medical devices, motor vehicles and certified aviation products; products for national security or defence; spare parts; and free and open-source software developed outside a commercial activity.
What a manufacturer must do
- Build security in. The 14 product requirements of Annex I, Part I — see the 22 Annex I requirements.
- Handle vulnerabilities after sale, for a support period of at least five years in principle — see the support period.
- Report actively exploited vulnerabilities and severe incidents to ENISA's platform, starting with a 24-hour early warning — see the early warning.
- Classify the product: default, important Class I or II, or critical. The class decides how you prove conformity — see Class I and Class II.
- Write the technical documentation — see the Annex VII checklist.
- Inform users, with the nine items of Annex II — see user information.
- Declare conformity: sign the EU declaration of conformity and affix the CE marking.
Fines
From 11 December 2027, breaches of the essential requirements and of the core manufacturer obligations can be fined up to €15 million or 2.5% of worldwide annual turnover, whichever is higher — see the three penalty tiers.
Where to start
If you already sell connected products, start with reporting: it applies now, and to products you have already sold — see products already on the market.
Then plan the Annex I work toward December 2027. For most manufacturers, the security requirements are the bigger lift.
Sources
- Regulation (EU) 2024/2847, Articles 2, 3, 13, 14, 64, 69 and 71; Annexes I, II and VII — Official Journal of the European Union
Position as at 20 September 2026. General information, not legal advice.