Guides to the Cyber Resilience Act

Each guide answers one question, links every legal statement to the official text and shows its review status. They explain the text; they do not replace it.

• What is the Cyber Resilience Act?Plain-English overview of Regulation (EU) 2024/2847: purpose, structure, who it concerns, core obligations, conformity, reporting, enforcement and key dates.NEEDS REVIEW
• Who and what is in scope of the Cyber Resilience Act?Which products the CRA covers, what counts as making available on the market, how open-source and cloud back-ends are treated, and the main exclusions.NEEDS REVIEW
• Cyber Resilience Act timeline and transitional provisionsVerified CRA dates — entry into force, notified bodies, reporting obligations, general application — and how Article 69 treats products already on the market.NEEDS REVIEW
• Essential cybersecurity requirements of the Cyber Resilience ActAnnex I in plain English: the product properties of Part I, the vulnerability handling of Part II, the risk assessment, the support period rule and user information.NEEDS REVIEW
• CRA obligations by economic operator: manufacturers, importers, distributors and othersWho must do what under the CRA: manufacturers, authorised representatives, importers, distributors, persons making substantial modifications and open-source stewards.NEEDS REVIEW
• Vulnerability handling and reporting under the Cyber Resilience ActWhat the CRA requires of manufacturers for handling vulnerabilities (Annex I, Part II) and reporting exploited vulnerabilities and severe incidents (Article 14).NEEDS REVIEW
• Conformity assessment and CE marking under the Cyber Resilience ActWhich conformity assessment procedure applies to a product under the CRA, when a notified body is involved, and how the EU declaration and CE marking work.NEEDS REVIEW
• The Cyber Resilience Act and SaaS: when is a cloud service covered?How the CRA treats cloud and SaaS offerings: the remote data processing test, what the recitals say, and where NIS2 applies instead.NEEDS REVIEW
• The Cyber Resilience Act and open-source softwareWhen free and open-source software falls under the CRA, what open-source software stewards must do, and what manufacturers integrating open-source components must do.NEEDS REVIEW
• CRA, NIS2 and DORA compared: products, entities and financial servicesHow the Cyber Resilience Act, the NIS2 Directive and DORA differ — what each regulates, who is obliged, how incident reporting works and how they connect.NEEDS REVIEW
• SBOM requirements under the Cyber Resilience Act, explainedWhat the CRA requires for the software bill of materials: content, format, who can ask for it, and what the text does not require, such as publication.NEEDS REVIEW