Cyber Resilience Act, CRA

Regulation (EU) 2024/2847 on cyber resilience – also known as the Cyber Resilience Act or CRA – is a European Union regulation aimed at improving the cybersecurity of products with digital elements placed on the EU market.

In future, compliance with the requirements of the CRA will be a precondition for placing a product on the EU market. 

Who and what does the CRA apply to?

Economic operators covered by the CRA

The Cyber Resilience Act applies to economic operators that place products with digital elements on the EU market. These include, for example:

• manufacturers
• importers
• distributors
• open-source software stewards in certain circumstances

If your organisation develops, manufactures, imports or sells digital products on the EU market, the Cyber Resilience Act is likely to apply to your activities.

Products covered by the CRA

The Cyber Resilience Act applies to products with digital elements. In practice, this means hardware and software that operate in a digital environment and can be connected, directly or indirectly, to a network.

The regulation applies, for example, to:

• consumer smart devices such as security cameras, televisions, toys and home routers
• software and applications such as games, word processing and image editing software, operating systems, browsers and password management software
• industrial and technical digital systems such as industrial control systems, connectable IoT devices and certain microprocessors and microcontrollers

For IoT devices, a remote data processing solution provided by the manufacturer, such as a service for remote management of the device, is also considered part of the product. This may include, for example, a cloud-based component that enables remote management or data processing.

The regulation may also apply to cloud services where they form part of a product or of a remote processing solution provided by its manufacturer.

Products not covered by the CRA

The regulation does not apply, for example, to:

• medical devices
• in vitro diagnostic medical devices
• certain vehicles
• marine equipment
• certified aviation equipment, such as aircraft

These are already subject to product-specific cybersecurity requirements.

The regulation also does not apply to products intended exclusively for national security or defence purposes.

What obligations does the CRA impose on economic operators?

The Cyber Resilience Act sets out obligations for economic operators that place products with digital elements on the EU market. These obligations vary depending on the role of the operator and relate, for example, to ensuring that products meet the cybersecurity requirements and to reporting vulnerabilities affecting the products.

When do the CRA provisions apply?

Key dates of the Cyber Resilience Act

10 December 2024 – Entry into force

The Cyber Resilience Act entered into force in the EU. From this date, the transition period begins before the obligations apply.

11 June 2026 – Application of provisions on notified bodies begins

11 September 2026 – Vulnerability reporting obligations begin

Manufacturers must report actively exploited vulnerabilities and severe security incidents to the authorities. This obligation applies to both new products and products already on the EU market.

11 December 2027 – Application of essential cybersecurity requirements and conformity assessment provisions begins

The essential cybersecurity requirements apply to products placed on the EU market from 11 December 2027 onwards.

Reporting of vulnerabilities and security incidents affecting products

The Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents affecting the security of a product. This obligation applies to both new products and products already on the EU market.

The manufacturer must submit an early warning notification, a follow-up notification and a final report. From 11 September 2026 onwards, all notifications must be submitted through the Single Reporting Platform maintained by ENISA. At present, the NCSC-FI does not have a separate form for submitting notifications.

What is an actively exploited vulnerability?

Actively exploited vulnerabilities are vulnerabilities where a malicious actor has exploited a weakness in a product with digital elements that has been made available on the market by the manufacturer. Mandatory reporting does not apply where a vulnerability is identified without malicious intent, for example through good faith testing or research, including bug bounty programmes.

What is a severe incident having an impact on product security?

A severe incident having an impact on the security of a product refers to situations where an event affects the availability, authenticity, integrity or confidentiality of a product. Such incidents may occur, for example, in the manufacturer’s development, production or maintenance processes. One example is a situation where an attacker has successfully injected malware into the manufacturer’s software update distribution channel.

Notifications submitted via the Single Reporting Platform are forwarded to the responsible CSIRT entity, which is generally the CSIRT of the country where the report is made. The information is also forwarded to the CSIRTs of the countries where the product is made available.

When making the notification the manufacturer may request the responsible CSIRT to delay the notification if one of the following conditions is met:

• the notified vulnerability has been actively exploited by a malicious actor and, according to the information available, it has only been exploited in the Member State of the CSIRT designated as coordinator to which the manufacturer has notified the vulnerability
• any immediate further dissemination of the notified vulnerability would likely result in the supply of information the disclosure of which would be contrary to the essential interests of that Member State
• the notified vulnerability poses an imminent high cybersecurity risk due to the further dissemination of the information

In such cases, the CSIRT will assess the situation and make a decision based on the available information. The CSIRT may also decide on its own initiative to delay the transmission of the notification without a separate request if the above conditions are met.

What requirements does the CRA impose on products?

Manufacturers must ensure that a product is designed, developed and produced in accordance with the essential cybersecurity requirements set out in the Cyber Resilience Act. These requirements cover both the technical characteristics of the product and the manufacturer’s obligations to manage vulnerabilities and provide security updates throughout the product lifecycle.

The detailed requirements are laid down in Article 13 and Annex I of the Cyber Resilience Act. Compliance with the requirements is demonstrated by CE marking.

The essential cybersecurity requirements apply to products placed on the EU market from 11 December 2027 onwards. Placing on the market means making a product available on the EU market for the first time.

The essential cybersecurity requirements are implemented on the basis of risks. They include, for example:

• secure default configurations and automatic security updates
• protection against unauthorised access
• confidentiality of data processing and data minimisation
• safeguarding of critical functions

Further details will be set out in harmonised standards and technical specifications. Harmonised standards are published in the Official Journal of the European Union as they become available.

How is conformity assessed?

Before a product can be placed on the EU market, the manufacturer must demonstrate that it complies with the essential cybersecurity requirements of the Cyber Resilience Act. This is known as conformity assessment.

The assessment procedure depends on the category of the product. In most cases, the manufacturer can carry out the assessment itself, but in certain cases a notified body is involved.

Find your product category below to see the applicable assessment procedure.

.