Cyber Resilience Act (CRA)

Regulation (EU) 2024/2847 is built on the New Legislative Framework used for other EU product law: essential requirements in the regulation, harmonised standards that give a presumption of conformity, conformity assessment, an EU declaration of conformity and the CE mark. Its scope is "products with digital elements" placed on the EU market, meaning hardware and software including remote data processing solutions that the product needs to perform a function. Pure SaaS is outside unless it is such a remote processing component, and products already covered by sectoral regimes, such as medical devices under the MDR/IVDR, motor vehicles and civil aviation, are excluded. Annex I Part I sets product properties (no known exploitable vulnerabilities at release, secure-by-default configuration with a reset option, protection against unauthorised access, confidentiality and integrity of data, data minimisation, attack-surface reduction, security logging), while Part II sets vulnerability-handling duties: an SBOM covering at least top-level dependencies, a coordinated vulnerability disclosure policy, and security updates delivered separately from feature updates where technically feasible and free of charge.

Risk classes drive the conformity route. Default products can use internal control (module A self-assessment). Important products in Annex III, split into class I (for example password managers, VPNs, routers, smart-home locks and cameras) and class II (for example firewalls, hypervisors, tamper-resistant microprocessors), need harmonised standards or third-party assessment, class II always involving a notified body. Critical products in Annex IV, such as smartcards and secure elements, can be made subject to European cybersecurity certification. Under Art. 13(8) the support period must reflect expected use and is at least five years unless the product is expected to be used for less.

Reporting under Art. 14 has applied since 11 September 2026. On becoming aware of an actively exploited vulnerability or a severe incident affecting the product's security, the manufacturer must submit an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a corrective measure is available (vulnerabilities) or within one month (incidents). Submissions go once through ENISA's single reporting platform (Art. 16) to the CSIRT designated as coordinator and to ENISA. Notified-body provisions applied from 11 June 2026; the remaining obligations apply from 11 December 2027.

Art. 64 sets three fine tiers: up to EUR 15 million or 2.5% of worldwide turnover for breaching the essential requirements and core manufacturer duties, EUR 10 million or 2% for other obligations, and EUR 5 million or 1% for misleading information to authorities. Open-source software developed outside a commercial activity is not caught, but "open-source software stewards" that systematically support such projects get a light-touch regime (Art. 24). The CRA differs from NIS2 in its object: NIS2 regulates operators, the CRA regulates the product lifecycle, so a NIS2 entity's supply-chain measures will increasingly rely on CRA conformity evidence from vendors.