IN SHORT
The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847. It sets EU-wide cybersecurity rules for products with digital elements — hardware and software products, including their remote data processing solutions — that are made available on the EU market. It requires those products to meet essential cybersecurity requirements in their design and throughout a defined support period, requires manufacturers to handle and report vulnerabilities, and links market access to conformity assessment and the CE marking. Most obligations apply from 11 December 2027, but the manufacturers’ reporting obligations apply from 11 September 2026 and the rules on notified bodies from 11 June 2026.
What the Regulation is for
Article 1 describes four things the Regulation lays down (Article 1):
- rules for making products with digital elements available on the market so that they are cybersecure (Article 1, point (a));
- essential cybersecurity requirements for the design, development and production of those products, and obligations for the economic operators concerned (Article 1, point (b));
- essential requirements for the vulnerability handling processes that manufacturers must run while the products are expected to be in use (Article 1, point (c));
- rules on market surveillance and enforcement (Article 1, point (d)).
In practice, the CRA turns cybersecurity into a condition for selling a connected product in the EU, in the same way that safety requirements already apply to many other products.
Legal nature: a regulation, not a directive
The CRA is a regulation. Its final formula states that it is binding in its entirety and directly applicable in all Member States (see the end of Article 71). There is no national transposition of its core rules: the same text applies everywhere in the EU.
Our interpretation
Because the matters it harmonises are set at EU level, Member States should not add their own cybersecurity requirements for making these products available on the market; buyers, however, remain free to demand stricter requirements for their own procurement or use (Recital 13). Some elements are still left to Member States — notably the rules on penalties (Article 64(1)) and the designation of authorities.
How the text is organised
The Regulation contains 130 recitals, 71 articles in 8 chapters, and 8 annexes. You can read all of them in the regulation explorer.
| Part | Content |
|---|---|
| Chapter I (Articles 1–12) | Subject matter, scope, definitions, requirements for products, important and critical products |
| Chapter II (Articles 13–26) | Obligations of manufacturers, authorised representatives, importers, distributors; open-source software stewards; reporting |
| Chapter III (Articles 27–34) | Conformity: standards, EU declaration of conformity, CE marking, technical documentation, conformity assessment procedures |
| Chapter IV (Articles 35–51) | Notification of conformity assessment bodies |
| Chapter V (Articles 52–60) | Market surveillance and enforcement |
| Chapter VI (Articles 61–62) | Delegated powers and committee procedure |
| Chapter VII (Articles 63–65) | Confidentiality and penalties |
| Chapter VIII (Articles 66–71) | Amendments to other acts, transitional and final provisions |
| Annexes I–VIII | Essential requirements, user information, important and critical product categories, declarations of conformity, technical documentation, conformity assessment procedures |
What and who it concerns
The CRA applies to products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a data connection to a device or network (Article 2(1)). A “product with digital elements” is defined broadly as a software or hardware product and its remote data processing solutions Article 3, point (1)
. There are exclusions — for example products covered by the EU rules on medical devices or motor vehicles — which are explained in our scope guide.
Obligations fall on economic operators: manufacturers, authorised representatives, importers, distributors, and other persons in specific cases (Article 3, point (12)). A lighter regime applies to open-source software stewards. See obligations by economic operator.
The core rule
What the text requires
A product with digital elements may be made available on the market only where it meets the essential cybersecurity requirements of Part I of Annex I (product properties) — provided it is properly installed, maintained, used as intended and updated — and where the manufacturer’s processes meet Part II of Annex I (vulnerability handling) (Article 6).
The two parts of Annex I are summarised in our guide to the essential requirements. Part I covers properties such as being placed on the market without known exploitable vulnerabilities and with a secure-by-default configuration (Annex I, Part I, point 2). Part II covers processes such as identifying components (including a software bill of materials), fixing vulnerabilities without delay, and running a coordinated vulnerability disclosure policy (Annex I, Part II).
Manufacturers carry most of the obligations
Manufacturers must, among other things, carry out and document a cybersecurity risk assessment, exercise due diligence on third-party components, handle vulnerabilities for a support period they determine according to the rules of the Regulation, draw up technical documentation, carry out conformity assessment, issue the EU declaration of conformity and affix the CE marking (Article 13). The support period has a specific rule — it is not a fixed duration for every product; see Essential cybersecurity requirements.
Reporting actively exploited vulnerabilities and severe incidents
Manufacturers must notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product to the CSIRT designated as coordinator and to ENISA, through a single reporting platform, with an early warning within 24 hours (Article 14(1), Article 14(2), Article 14(3), Article 14(4)). These reporting obligations apply from 11 September 2026, including for products already on the market. The details are in our vulnerability management guide.
Conformity assessment and CE marking
Before placing a product on the market, the manufacturer must demonstrate conformity using one of the procedures listed in Article 32 (Article 32(1)). For most products this can be internal control (module A). Important products listed in Annex III and critical products listed in Annex IV are subject to stricter procedures (Article 32(2), Article 32(3), Article 32(4)).
Our interpretation
A third-party assessment by a notified body is therefore required only in defined cases — for example for class II important products, or for class I important products when harmonised standards, common specifications or certification schemes have not been fully applied. It is not the default for every product. See our conformity assessment guide.
Enforcement
Market surveillance follows the general EU framework of Regulation (EU) 2019/1020 (Article 52(1)). Member States lay down penalties (Article 64(1)). The Regulation sets maximum administrative fines: up to EUR 15 000 000 or 2.5 % of total worldwide annual turnover, whichever is higher, for non-compliance with the essential requirements and with Articles 13 and 14 (Article 64(2)); lower ceilings apply to other obligations (Article 64(3), Article 64(4)).
Key dates
| Date | What happens |
|---|---|
| 10 December 2024 | Entry into force (twentieth day after publication in the Official Journal on 20 November 2024) — Article 71(1) |
| 11 June 2026 | Chapter IV (notification of conformity assessment bodies) applies — Article 71(2) |
| 11 September 2026 | Article 14 (manufacturers’ reporting obligations) applies — Article 71(2) |
| 11 December 2027 | The Regulation applies in general — Article 71(2) |
The dates of 11 June and 11 September 2026 concern two different things: the first is about bodies that will carry out conformity assessments, the second is about manufacturers reporting vulnerabilities and incidents. See the timeline and transitional provisions.
Uncertain / awaiting guidance
Several elements are completed by later acts of the Commission — for example delegated acts on the categories of critical products (Article 8(1)) and implementing acts on the format of notifications (Article 14(10)) and of the software bill of materials (Article 13(24)) — and by harmonised standards. Check the Commission’s CRA page, which links to an FAQ on implementation, for the current state of these measures.
How to use this site
- The official text (all recitals, articles and annexes, with the corrigenda published in the Official Journal marked) is in the regulation explorer. Every paragraph has a stable link.
- Explanations like this one are separate from the legal text, list their sources and show their review status. They are information, not legal advice.
Fictional example — Acme Sensors
Acme Sensors, a fictional company, makes a Wi-Fi temperature sensor and the mobile app and cloud back-end that the sensor needs to work. Under the CRA, Acme would look at the sensor, the app and the back-end functions the product cannot work without as one product with its remote data processing solution, carry out a risk assessment, decide a support period, prepare its vulnerability handling and reporting process before 11 September 2026, and complete conformity assessment and CE marking before placing new units on the market from 11 December 2027.