The questions manufacturers ask us most often, answered in a few sentences each.
As of October 2026. Not legal advice.
It covers products with digital elements made available on the EU market, hardware and software, whose intended use includes a data connection to a device or network. Products covered by specific EU product law, such as medical devices and vehicles under type approval, are excluded.
The reporting obligations apply to all products on the market since 11 September 2026. The other requirements apply to products placed on the market from 11 December 2027, or to earlier products that are substantially modified.
The manufacturer sets a support period that reflects how long the product is expected to be in use, in principle at least five years unless the product is expected to be used for less. During it, vulnerabilities must be handled and security updates provided.
Free and open-source software that is not monetised in the course of a commercial activity is generally outside scope. Open-source software stewards have a lighter set of obligations. Manufacturers that integrate open source remain responsible for their product.
Remote data processing that the manufacturer designs and without which the product cannot perform one of its functions counts as part of the product.
Reports go through the single reporting platform operated by ENISA to the CSIRT designated as coordinator in the member state of your main establishment, and to ENISA.
Harmonised standards for the CRA are still being developed. IEC 62443-4-1 and 4-2 cover a large part of the essential requirements and are a strong basis, but a gap check against Annex I is still needed.
No. The SBOM is part of the technical documentation and must be provided to market surveillance authorities on request.
Up to 15 million euros or 2.5 percent of worldwide annual turnover for breaches of the essential requirements and manufacturer obligations, and lower ceilings for other breaches.
As of October 2026. These guides explain the regulation in plain language and are not legal advice.
Your question is not here? Our engineers answer it in a short call and check your product with you.
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.
