Cyber Resilience Act: what your company has to do, and when

In short

• What: Regulation (EU) 2024/2847, published in the Official Journal on 20 November 2024, in force since 10 December 2024.
• Who: manufacturers, importers and distributors of products with digital elements placed on the EU market.
• Already mandatory: reporting actively exploited vulnerabilities and severe incidents, since 11 September 2026.
• Everything else: essential requirements, technical documentation, CE marking, on 11 December 2027.
• Penalties: up to €15 million or 2.5% of worldwide turnover.

Who is covered?

The CRA covers products with digital elements: any software or hardware that connects, directly or indirectly, to another device or a network. Licensed software, an application installed at the customer’s site, an agent, firmware, a router or a connected camera are all in scope.

Most obligations fall on the manufacturer: whoever designs or has the product designed and sells it under their own name. Importers and distributors have verification duties.

Excluded, because other laws cover them: medical devices, vehicles, aviation, marine equipment and products built for defence or national security. A pure SaaS service is not a product under the CRA, unless it performs remote data processing a product needs to work (the cloud backend of a connected device, for example). Free and open-source software developed outside any commercial activity is excluded; foundations that sustainably support open-source software used commercially have a lighter regime.

Products are classified: the vast majority fall into the default category (self-assessment by the manufacturer). “Important” products (classes I and II: browsers, password managers, VPNs, firewalls…) and “critical” ones need a stricter assessment, sometimes by a notified body.

Timeline

Reporting applies from September 2026 to all products on the market, even those sold before. The other requirements only concern products placed on the market from December 2027, but a product that keeps being sold is subject to them from that date.

The manufacturer’s four obligations

1. Security by design. The product is designed, developed and delivered according to the essential requirements of Annex I: no known exploitable vulnerability at delivery, secure default configuration, data protection, reduced attack surface, security updates possible. A risk assessment is documented.

2. Vulnerability handling. The manufacturer identifies and documents the product’s components, notably in a machine-readable software bill of materials (SBOM) covering at least top-level dependencies. It fixes vulnerabilities without delay, ships free security updates, runs a coordinated vulnerability disclosure policy and provides a contact point for reporting flaws.

3. Reporting within 24 hours. Every actively exploited vulnerability and every severe incident affecting the product’s security is notified to ENISA and the coordinating CSIRT, in three steps: 24 hours, 72 hours, then a final report. See the reporting process step by step.

4. Support for the whole period of use. The manufacturer sets a support period (at least five years, unless the product is expected to be used for less), states it clearly at purchase and provides security updates during that period. Technical documentation and the EU declaration of conformity are kept for ten years.

Penalties

Market surveillance authorities can also order corrective action, withdrawal or recall of a product. Micro and small enterprises cannot be fined for missing the 24-hour early warning deadline alone; the other deadlines and obligations still apply to them.

Checklist for an SME

• List your products in scope and their category (default, important, critical).
• Generate an SBOM for every release (CycloneDX or SPDX), from your CI.
• Monitor daily the vulnerabilities affecting those components, exploited ones first (CISA KEV catalog, European EUVD database).
• Publish a security contact, for example a /.well-known/security.txt file, and a coordinated disclosure policy.
• Prepare the reporting process now: who decides, who sends, within 24 hours, weekends included.
• Decide and display the support period of each product.
• Document your decisions on non-exploitable vulnerabilities (VEX statements) so you can justify them.
• Gather the technical documentation: risk assessment, SBOM, test results, update procedure.

How CheckOps helps

CheckOps receives your SBOMs and scanner results, compares them every day with the EUVD, OSV, KEV and EPSS databases, and alerts you when an exploited vulnerability affects one of your products. It prepares the three CRA reporting steps with their deadlines, keeps the history of your VEX decisions and generates the technical file and the PDF report of each release. Hosted in France, with no dependency on a US cloud.

Frequently asked questions