EU Cyber Resilience Act (CRA): What It Is, Timeline and Requirements for Hardware and Software Makers

The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is an EU law that sets mandatory cybersecurity requirements for hardware and software products sold in the EU, and compliant products carry the CE marking. Manufacturers anywhere, including Canada and the US, have had to report actively exploited vulnerabilities since 11 September 2026, and the full requirements apply from 11 December 2027.

A typical case is a connected industrial gateway sold to EU customers, with firmware, a companion app and a cloud console the gateway needs to work. Under the Cyber Resilience Act, all three are one product. Its maker needs a CE marking by December 2027, and already owes a 24-hour warning if attackers exploit a flaw in the gateway today. EU importers and distributors must check that CE marking before they sell the product, so it becomes a condition of EU revenue.

What Is the Cyber Resilience Act?

The Cyber Resilience Act is an EU product law for cybersecurity. Article 2 applies it to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.

A product with digital elements is a software or hardware product and its remote data processing solutions, including components sold separately. Remote data processing means backend software the manufacturer designs, without which the product cannot perform one of its functions. A cloud console that controls a device is part of that device. Cloud services built outside a manufacturer's responsibility are outside the CRA, and the recitals point to the NIS2 Directive (EU) 2022/2555 for cloud services such as SaaS.

Who the Cyber Resilience Act Covers, and What It Excludes

The Cyber Resilience Act puts most obligations on the manufacturer: whoever develops or manufactures a product, or has it made, and markets it under their own name or trademark. Location does not matter. A Canadian or US company selling into the EU is the manufacturer, and its EU importer must check the conformity assessment, technical documentation and CE marking before selling the product.

Article 2 excludes products covered by their own EU rules:

Free and open-source software that is published but not made available on the market in the course of a commercial activity is outside the CRA. A company that builds open-source components into a commercial product is still the manufacturer, and Article 13(5) requires due diligence on those components. Organizations that support open-source projects intended for commercial use are open-source software stewards, with lighter duties under Article 24.

Cyber Resilience Act Timeline: Key Dates From 2024 to 2027

The Cyber Resilience Act timeline has four dates, set in Article 71 and confirmed by the European Commission.

Under Article 69, a product placed on the market before 11 December 2027 only has to meet the full requirements if it is substantially modified after that date. Reporting is the exception: Article 14 covers every in-scope product, including those already on sale.

Cyber Resilience Act Requirements: Annex I Essential Cybersecurity Requirements

The Cyber Resilience Act requirements are in Annex I, which has two parts: properties the product must have and processes the manufacturer must run. Both rest on a cybersecurity risk assessment under Article 13, kept in the technical documentation with a justification for any requirement treated as not applicable.

Annex I Part I requires products, where applicable, to:

• be placed on the market without known exploitable vulnerabilities, with a secure by default configuration;
• support security updates, with automatic updates on by default where applicable and a clear opt-out;
• protect against unauthorised access through authentication and access management;
• protect the confidentiality and integrity of data, commands, programs and configuration, for example with encryption;
• process only the data needed for the intended purpose;
• protect availability, limit attack surfaces and use exploit mitigation;
• log relevant security activity, and let users securely delete all data and settings.

Annex I Part II requires manufacturers to:

1. document components and vulnerabilities, including a machine-readable software bill of materials (SBOM) covering at least top-level dependencies;
2. fix vulnerabilities without delay, with security updates separate from feature updates where feasible;
3. test and review product security regularly;
4. publish information about fixed vulnerabilities once an update is available;
5. enforce a coordinated vulnerability disclosure policy;
6. provide a contact address for reporting vulnerabilities;
7. distribute updates securely, and automatically where applicable;
8. release security updates without delay and free of charge, with advisory messages.

CRA Support Period and Security Updates

The CRA support period is how long the manufacturer must handle a product's vulnerabilities to the Annex I Part II standard. Article 13(8) ties it to how long the product is expected to be in use, with a minimum of five years, or the expected use time if that is shorter. The recitals expect longer periods for long-lived products such as routers and industrial control systems.

The end date, with at least month and year, must be clear at the time of purchase. Each security update must stay available for at least 10 years or the rest of the support period, whichever is longer, and the technical documentation must be kept for the same length of time.

CRA Reporting: Actively Exploited Vulnerabilities and Severe Incidents

Article 14 of the Cyber Resilience Act requires manufacturers to notify the national CSIRT designated as coordinator and ENISA at the same time, through ENISA's Single Reporting Platform. ENISA launched the platform on 11 September 2026.

An actively exploited vulnerability is one with reliable evidence that a malicious actor has exploited it without the system owner's permission. A severe incident affects the product's ability to protect sensitive data or functions, or leads to malicious code running.

Notifications go to the CSIRT where the manufacturer has its main EU establishment. A Canadian or US manufacturer with none follows Article 14(7): the Member State of its authorised representative first, then of its importer. The SOC 2 incident response guide for on-prem environments covers the detection and escalation a 24-hour clock depends on.

CRA Product Classes and Conformity Assessment Routes

The Cyber Resilience Act sorts products into four groups, and the group decides between self-assessment and a notified body. Annex III lists important products in classes I and II, and Annex IV lists critical products.

Class I self-assessment depends on harmonised standards. CEN, CENELEC and ETSI accepted the Commission's standardisation request M/606 on 3 April 2025 to develop them, as horizontal standards for all products and vertical standards for specific product types.

Cyber Resilience Act Penalties

Article 64 of the Cyber Resilience Act sets the maximum fines Member States must provide for:

• EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching Annex I or the obligations in Articles 13 and 14;
• EUR 10 million or 2% for breaching other listed obligations, including importer, distributor, documentation and CE marking rules;
• EUR 5 million or 1% for giving incorrect or misleading information to notified bodies or authorities.

Microenterprises and small enterprises cannot be fined for missing the 24-hour early warning, and open-source software stewards cannot be fined. Authorities can also require a non-compliant product to be corrected, withdrawn or recalled.

What to Do Now: A 6-Step Cyber Resilience Act Plan

A manufacturer can prepare for the Cyber Resilience Act in six steps, starting with the reporting duty that already applies.

1. Build a product inventory. List every product sold into the EU, the versions still in use and the cloud services each depends on.
2. Classify each product against Annexes III and IV and the Article 2 exclusions, which decides between self-assessment and a notified body.
3. Generate an SBOM per release from the build pipeline, so a new CVE can be matched to affected products quickly.
4. Set up vulnerability handling and coordinated disclosure. Publish a disclosure policy and contact, set fix timelines, and write the Article 14 runbook: who decides a vulnerability is actively exploited, who files the report, and who covers weekends.
5. Start the technical documentation: the risk assessment, how each Annex I requirement is met, test results and the SBOM.
6. Decide the support period per product, check that chip and component suppliers support it for as long, and price the patching cost into the product.

The SOC 2 vulnerability scanning guide for on-prem servers and the ISO 27001 A.8.8 technical vulnerabilities guide cover triage and fix timelines for step 4, and the SOC 2 secure development guide for self-hosted GitLab covers the pipeline controls behind step 3.

How the Cyber Resilience Act Relates to SOC 2 and ISO 27001

The Cyber Resilience Act covers the product, while SOC 2 and ISO 27001 cover the company and the service it operates. SOC 2 is a CPA firm's report on a service organization's controls against the AICPA Trust Services Criteria. ISO/IEC 27001:2022 sets requirements for an information security management system. Neither replaces a CRA conformity assessment or CE marking.

One security program can feed all three. Vulnerability management, secure development, incident response and supplier management are capabilities SOC 2 auditors and ISO 27001 certification bodies already test. The CRA asks for the same capabilities, aimed at a product, with legal deadlines. A working SOC 2 vulnerability process extends to the CRA with SBOMs, a public disclosure policy and the Article 14 runbook.

The SOC 2 vs ISO 27001 comparison explains how the two frameworks share controls, the SOC 2 Trust Services Criteria guide lists what an audit tests, and the SOC 2 scoping guide for hybrid and on-prem infrastructure covers the system boundary for companies that also build hardware.

The Cyber Resilience Act Makes Product Security a Condition of EU Sales

The Cyber Resilience Act makes product security a condition of selling into the EU, the way SOC 2 became a condition of enterprise software deals. Both the reporting duty and the 2027 requirements depend on a vulnerability process that works under a 24-hour clock. The SOC 2 for bare metal and on-prem infrastructure page covers the security program for companies that run their own hardware, and the same program can produce the CRA evidence.

Related Guides

• IEC 62443 Explained: 4-1, 4-2, 3-3, Security Levels and Certification for Product Companies
• SOC 2 vs IEC 62443 vs ETSI EN 303 645: Which Does Your Hardware Customer Want?
• SOC 2 for Hardware Startups: What's in Scope When You Sell Devices, Chips or Appliances
• Is Firmware in SOC 2 Scope? OTA Updates, Signing Keys and Device Fleets

Frequently Asked Questions

What is the Cyber Resilience Act in simple terms?

The Cyber Resilience Act is an EU law, Regulation (EU) 2024/2847, that sets cybersecurity requirements for connected hardware and software sold in the EU. Manufacturers must build products securely, fix vulnerabilities for at least five years, report exploited vulnerabilities and affix the CE marking.

When does the Cyber Resilience Act apply?

The Cyber Resilience Act entered into force on 10 December 2024. Notified body rules apply from 11 June 2026, reporting of actively exploited vulnerabilities and severe incidents from 11 September 2026, and all other obligations, including conformity assessment and CE marking, from 11 December 2027.

Does the Cyber Resilience Act apply to companies outside the EU?

Yes. The Cyber Resilience Act applies to products sold on the EU market, wherever the manufacturer is based. A Canadian or US company selling into the EU is the manufacturer, its EU importer must verify conformity, and it can appoint an authorised representative in the EU.

Does the Cyber Resilience Act apply to SaaS?

Stand-alone SaaS is generally outside the Cyber Resilience Act, and the CRA recitals point to the NIS2 Directive for cloud services. The CRA does cover remote data processing: backend software a manufacturer designs, without which its product cannot perform a function, such as a cloud console that controls a device.

Is SOC 2 or ISO 27001 enough for the Cyber Resilience Act?

No. SOC 2 and ISO 27001 assess the company and its service, while the Cyber Resilience Act assesses each product through conformity assessment and CE marking. Their vulnerability management and incident response controls give a manufacturer a head start on the CRA.

Sources

• EUR-Lex, Regulation (EU) 2024/2847 (Cyber Resilience Act)
• European Commission, Cyber Resilience Act
• European Commission, Cyber Resilience Act summary of the legislative text
• ENISA, The CRA Single Reporting Platform is launched
• CEN-CENELEC, CRA standardization request accepted by CEN, CENELEC and ETSI
• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• ISO, ISO/IEC 27001:2022 Information security management systems