Explanation
What the regulation does
Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA), sets horizontal cybersecurity rules for products with digital elements — hardware and software — placed on the EU market. Article 1 lists four things the regulation lays down:
- rules for making products with digital elements available on the market to ensure their cybersecurity (Article 1, point (a));
- essential cybersecurity requirements for the design, development and production of those products, and obligations for economic operators (Article 1, point (b));
- essential cybersecurity requirements for the vulnerability handling processes that manufacturers put in place for the time products are expected to be in use (Article 1, point (c));
- rules on market surveillance and enforcement (Article 1, point (d)).
The CRA is a regulation, not a directive: it applies directly in every Member State without national transposition. National authorities still play a role — for example market surveillance authorities and the CSIRTs that receive notifications — but the obligations themselves are in the EU text.
Two families of requirements
The core rule is in Article 6. A product with digital elements may be made available on the market only if two conditions are met.
What the text requires
The product must meet the essential cybersecurity requirements of Part I of Annex I — provided it is properly installed, maintained and used, and the necessary security updates have been installed (Article 6, point (a)). And the processes put in place by the manufacturer must comply with the vulnerability handling requirements of Part II of Annex I (Article 6, point (b)).
This split runs through the whole regulation: Part I of Annex I is about the properties of the product (secure by default, protection of data, limited attack surface, and so on); Part II is about how the manufacturer handles vulnerabilities over time (software bill of materials, security updates, coordinated vulnerability disclosure, and so on). Lesson 3 covers both in detail.
How the text is organised
The regulation contains 130 recitals, 71 articles in eight chapters, and eight annexes.
| Chapter | Articles | Subject |
|---|---|---|
| I | 1–12 | General provisions: scope, definitions, important and critical products |
| II | 13–26 | Obligations of economic operators; reporting; open-source software stewards |
| III | 27–34 | Conformity: standards, EU declaration of conformity, CE marking, technical documentation, conformity assessment procedures |
| IV | 35–51 | Notification of conformity assessment bodies |
| V | 52–60 | Market surveillance and enforcement |
| VI | 61–62 | Delegated powers and committee procedure |
| VII | 63–65 | Confidentiality and penalties |
| VIII | 66–71 | Amendments to other acts, transitional and final provisions |
The annexes carry much of the technical substance: Annex I (essential cybersecurity requirements), Annex II (information and instructions to the user), Annex III and Annex IV (important and critical product categories), Annex V and Annex VI (EU declaration of conformity), Annex VII (technical documentation) and Annex VIII (conformity assessment procedures).
Our interpretation
Recitals explain why the provisions were adopted and help to understand them — for example Recital 12 on cloud solutions. The obligations themselves are set out in the articles and annexes, so a legal conclusion should always be traced back to an article or an annex.
A text that will be completed
The regulation empowers the Commission to adopt further acts. For example, it requires an implementing act with the technical description of the product categories of Annexes III and IV (Article 7(4)), allows an implementing act on the format of the software bill of materials (Article 13(24)), and allows delegated acts to amend the lists of important and critical products (Article 7(3)). Products that conform to harmonised standards whose references are published in the Official Journal benefit from a presumption of conformity (Article 27(1), first subparagraph). Preparing for the CRA therefore means reading the regulation and following these complementary texts.
Key dates
What the text requires
The regulation entered into force on the twentieth day following its publication in the Official Journal (Article 71(1)) — publication was on 20 November 2024, so entry into force was 10 December 2024. It applies from 11 December 2027 (Article 71(2), first subparagraph). However, Article 14 (manufacturers' reporting obligations) applies from 11 September 2026 and Chapter IV (notification of conformity assessment bodies) from 11 June 2026 (Article 71(2), second subparagraph).
Two different things are called "notification" here: Chapter IV concerns how conformity assessment bodies are notified to the Commission; Article 14 concerns how manufacturers report actively exploited vulnerabilities and severe incidents. Do not mix them up.
What the text requires
Products placed on the market before 11 December 2027 are subject to the requirements of the regulation only if they undergo a substantial modification from that date (Article 69(2)). By way of derogation, the reporting obligations of Article 14 apply to all in-scope products placed on the market before 11 December 2027 (Article 69(3)).
What is at stake
Non-compliance with the essential cybersecurity requirements of Annex I and with the obligations of Articles 13 and 14 can be subject to administrative fines of up to EUR 15 million or, for an undertaking, up to 2.5 % of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 64(2)). Lower ceilings apply to other obligations.
Uncertain / awaiting guidance
Regulation (EU) 2025/327 on the European Health Data Space amends Articles 13(4) and 31(3) and inserts a new Article 32(5a). On our reading these changes apply from 26 March 2027; this date still has to be confirmed. They are shown next to the provisions concerned in the regulation explorer.
Practical case
Fictional example — Acme Sensors reads the CRA for the first time
Acme Sensors, a fictional company with 40 staff, makes connected air-quality sensors and a companion mobile app. Its managing director asks the engineering lead to "read the CRA" and report back within a week.
Rather than reading 71 articles in order, the engineering lead builds a reading map:
- Article 2 and Article 3 to confirm that the sensors and the app are products with digital elements in scope (lesson 2).
- Article 6 and Annex I to understand what the product and the company's processes must achieve (lesson 3).
- Article 13 for the manufacturer's obligations, and Article 14 for reporting — already applicable since 11 September 2026 (lesson 4).
- Annexes III and IV to check whether any product falls in an important or critical category, then Article 32 for the conformity assessment route (lesson 5).
- Article 71 and Article 69 for the timetable.
The report to the managing director lists the articles read, the open points and the dates — not a conclusion that the company "is compliant", which nobody can state at this stage.
Exercise
EXERCISE — FIND THE RIGHT PROVISION
Using the regulation explorer, answer the three questions below and note the exact provision for each.
- From which date does Article 14 apply?
- What starts to apply on 11 June 2026?
- A product was placed on the market in 2025 and is not modified afterwards. Which part of the regulation applies to it?
Show a suggested answer
- 11 September 2026 — Article 71(2), second subparagraph.
- Chapter IV (Articles 35 to 51) on the notification of conformity assessment bodies — Article 71(2), second subparagraph. It is not about reporting vulnerabilities.
- The reporting obligations of Article 14 (Article 69(3)). The other requirements apply only if the product undergoes a substantial modification from 11 December 2027 (Article 69(2)).
Key takeaways
KEY TAKEAWAYS
- The CRA is a directly applicable EU regulation on the cybersecurity of products with digital elements and on manufacturers' vulnerability handling.
- Article 6 combines two conditions: product properties (Annex I, Part I) and the manufacturer's processes (Annex I, Part II).
- 130 recitals, 71 articles, 8 chapters, 8 annexes; obligations are in the articles and annexes, recitals explain them.
- Key dates: entry into force 10 December 2024; Chapter IV from 11 June 2026; Article 14 from 11 September 2026; general application from 11 December 2027.
- Further implementing acts, delegated acts and harmonised standards will complete the framework.