The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for hardware and software products made available on the EU market.

For details about the regulation itself, see Regulation (EU) 2024/2847.

The CRA is a regulation of the European Union that requires manufacturers to ensure that products with digital elements are:

• designed and developed securely,

  • (CRA Article 6(1); Annex I, Part I)
• placed on the market without known exploitable vulnerabilities,

  • (CRA Annex I, Part I, point 2)
• supplied with security updates where necessary,

  • (CRA Article 13(8); Annex I, Part II, points 6–8)
• monitored for vulnerabilities throughout their support period, and

  • (CRA Article 13(6) and (8); Annex I, Part II)
• accompanied by the required technical documentation and conformity assessment.

  • (CRA Article 13(12); Article 32; Article 33; Annexes VII and VIII)

Compliant products generally require an EU Declaration of Conformity and CE marking.

The CRA also establishes reporting obligations for actively exploited vulnerabilities and severe incidents having an impact on product security.

The CRA generally applies to hardware and software products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical connection to a device or network. (CRA Article 2(1); Article 3(1), (8)–(10), (23) and (24))

Certain product categories governed by specific EU legislation are excluded or subject to special treatment, including some medical devices, motor vehicles, aviation products and marine equipment. (CRA Article 2(2) and (4)–(8))

Non-monetised free and open-source software is generally not considered placed on the market. A legal person that publishes and systematically supports such software intended for commercial use may nevertheless qualify as an open-source software steward and be subject to Article 24. (CRA Article 2(3); Article 3(48); Recitals 18 and 19)

A product is made available on the market when it is supplied for distribution or use on the EU market in the course of a commercial activity, whether in return for payment or free of charge. (CRA Article 3(22))

Placing on the market means making an individual product with digital elements available on the EU market for the first time. (CRA Article 3(21))

Depending on the circumstances, making a product available may include:

• selling or licensing standard software, (CRA Article 3(21) and (22))
• delivering custom software to a customer, (derived from CRA Article 3(13), (21) and (22))
• supplying a complete machine or test system containing digital elements, (CRA Article 2(1); Article 3(1), (13), (21) and (22))
• providing software free of charge as part of another commercial offering. (CRA Article 3(13) and (22); Recitals 15 and 18)

Software developed and used exclusively within one organisation is generally not made available on the market because it is not supplied to another party for distribution or use. (derived from CRA Article 3(22); see also Recital 15)

The CRA assigns obligations according to the organisation's role as an economic operator. (CRA Article 3(12); Chapter II)

• Manufacturers develop, manufacture or have products developed or manufactured and market them under their own name or trademark, whether for payment, monetisation or free of charge. (CRA Article 3(13); Article 13)
• Importers place products bearing the name or trademark of a manufacturer established outside the EU on the EU market. (CRA Article 3(16); Article 19)
• Distributors make products available within the supply chain without affecting their properties. (CRA Article 3(17); Article 20)

An importer or distributor becomes subject to the obligations of a manufacturer if it markets a product under its own name or trademark or carries out a substantial modification of a product already placed on the market. (CRA Article 21)

Other persons may also become manufacturers if they substantially modify a product and subsequently make it available on the market. (CRA Article 22)

A system integrator delivering a complete system under its own name can therefore become the manufacturer of that system. (derived from CRA Article 3(13); Article 21; Article 22)

The CRA is not limited to large companies. Microenterprises and SMEs receive specific support measures, but there is no general exemption from the CRA’s product and manufacturer obligations. (CRA Article 3(19); Article 26; Article 33; Article 67)

The following source hierarchy is recommended:

1. Legal text: The authoritative and legally binding source.

   • Regulation (EU) 2024/2847 on EUR-Lex
   • EUR-Lex summary of the CRA
2. European Commission guidance: Official implementation guidance and explanations. The Commission is required to issue guidance covering specified CRA topics. (CRA Article 26)

   • European Commission CRA overview
   • CRA implementation information
   • CRA implementation FAQ
   • Commission CRA implementation guidance
3. Harmonised standards and common specifications: These can provide a presumption of conformity with the CRA requirements they cover. (CRA Article 27; Article 28)

   • European Commission: CRA standardisation
4. National market-surveillance authorities: These authorities are responsible for market surveillance and enforcement. (CRA Article 52; Chapter V)
5. ENISA and national CSIRTs: These bodies are involved in vulnerability and incident reporting and in operating the CRA single reporting platform. (CRA Article 14; Article 15; Article 16; Article 17)

   • ENISA product security and certification

Products placed on the market before 11 December 2027 are generally subject to the remaining CRA requirements only if they undergo a substantial modification from that date. (CRA Article 69(2); definition in Article 3(30))

The reporting obligations in Article 14 also apply to products within the CRA’s scope that were placed on the market before 11 December 2027. (CRA Article 69(3))