The Cyber Resilience Act, explained for manufacturers.
What the CRA requires, when each part applies and how to prepare your products for the CE mark.
The CRA makes cybersecurity a condition for the CE mark.
Regulation (EU) 2024/2847 applies to products with digital elements sold in the EU: hardware and software that connect to a device or a network. From 11 December 2027, a product without the required security cannot carry the CE mark or be placed on the market.
The obligations do not end at release. Manufacturers must handle vulnerabilities, provide security updates and report actively exploited vulnerabilities for the whole support period of the product. The reporting duty already applies since 11 September 2026, including for products already on the market.
Who it affects
- Manufacturers of hardware and software products with digital elements
- Importers and distributors, who must check the manufacturer's compliance
- Open-source software stewards, with lighter duties
- Not covered: products under their own sector rules, such as medical devices, vehicles under type approval, aviation and marine equipment
Am I affected? A quick self-check
Answer these questions for each product. If the first four apply, the CRA very likely covers it.
1
Digital elements
Does the product contain software or firmware, or is it software itself?
2
Data connection
Can it connect to another device or a network, directly or indirectly, for example over USB, Bluetooth, a fieldbus or the internet?
3
EU market
Is it sold or otherwise made available in the EU as part of a commercial activity, whether paid or free of charge?
4
No exemption
Is it outside the excluded areas, such as medical devices, vehicles under type approval, civil aviation, marine equipment and national security?
5
Your role
Are you the manufacturer, an importer or a distributor? Each role has its own duties, and anyone who sells a product under their own name counts as the manufacturer.
6
Products already on the market
Do you sell connected products today? The reporting obligation already applies to them.
If the first four questions apply, the next step is the product class.
Find your product classWhat the CRA requires
Eight obligations every manufacturer must be able to prove. Each one is explained in our CRA guides.
Annex I Part I
Security by design
Products are designed, developed and produced to ensure an appropriate level of cybersecurity, with secure default settings.
Article 13
Cybersecurity risk assessment
A documented risk assessment for each product, used in design and kept up to date.
Annex I Part II
Vulnerability handling
A process to find, fix and disclose vulnerabilities, with a coordinated disclosure policy.
SBOM
Software bill of materials
A machine-readable list of the components in each product, kept in the technical documentation.
SBOM guideSupport period
At least five years
Security support for the expected use time of the product, normally at least five years.
Updates
Security updates
Security updates provided free of charge and, where possible, separate from feature updates.
Article 14
Reporting
Early warning within 24 hours, notification within 72 hours, then a final report, through the single reporting platform.
Reporting guideConformity
Technical documentation and CE mark
Conformity assessment, EU declaration of conformity and CE marking before the product is placed on the market.
Conformity guideCheck your product's CRA class
The first step is to know which class your product falls into. The CRA assessment in AITIGRITY guides you through intended use, functions and connectivity, and shows which conformity assessment route applies.
CRA assessment
A guided evaluation of scope and classification for products with digital elements.
Start the CRA assessmentThe CRA timeline
Entry into force
10 December 2024
The CRA enters into force.
Notified bodies
11 June 2026
Rules for notified bodies apply, so third-party assessments can be prepared.
Reporting
11 September 2026
Reporting of actively exploited vulnerabilities and severe incidents applies.
Full application
11 December 2027
All requirements apply. CE marking under the CRA becomes mandatory.
Product classes decide the conformity route
The class of your product determines who assesses conformity. Getting it right early decides your timeline and cost.
Default products
Most products with digital elements. The manufacturer can assess conformity itself (Module A).
Important products, class I
For example password managers, VPNs, routers, operating systems and smart home security devices. Self-assessment is possible when harmonised standards are applied in full; otherwise a third party is required.
Important products, class II
For example firewalls, intrusion detection systems, hypervisors and tamper-resistant microcontrollers. A third-party assessment (Module B+C or H) is required.
Critical products
For example smart meter gateways and smartcards. A European cybersecurity certificate may be required.
Product classes guideHow we help you meet the CRA
Our consulting and our toolchain support you from the first check to the CE mark. Each also works on its own.
Consulting
Our experts do it with you
For teams that need experienced people to scope, plan and implement CRA compliance.
- CRA Readiness Check: scope, product class and gap list per product
- Conformity route, technical documentation and EU declaration of conformity
- PSIRT set-up and a rehearsal of the 24-hour report
- Preparation for notified body assessments
Software
AITIGRITY keeps your evidence current
For teams that want to run CRA work themselves, for every product and every release.
- Concept: risk assessment for each product
- Requirements: security requirements linked to each risk
- Assessment: work products reviewed against the CRA
- Vulnerability management: component monitoring and support for 24 h and 72 h reports
CRA guides
Timeline
Every CRA date, and what it means for your projects.
Read the guideReporting
What to report, to whom, and within which deadline.
Read the guideSBOM
What the CRA expects from a software bill of materials.
Read the guideProduct classes
How to find the class of your product and its conformity route.
Read the guideConformity routes
Module A, B+C or H: who assesses what.
Read the guideFAQ
Short answers to the questions manufacturers ask most.
Read the guideQuestions we often hear
Does the CRA apply to software-only products?
Yes. Standalone software placed on the EU market is a product with digital elements, including apps and desktop software.
Our products are already on the market. Are we affected?
Yes, for reporting: the duty to report actively exploited vulnerabilities applies to all products on the market since 11 September 2026. The other requirements apply to products placed on the market from 11 December 2027, or substantially modified after that date.
Do we need a notified body?
It depends on the product class. Most default products can be self-assessed; class II and some class I products need a third party.
Product classesWhat are the penalties?
For breaches of the essential requirements, fines of up to 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.
Rheinpromenade 11, 40789 Monheim am Rhein, Germany