The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. The Cyber Resilience Act requires manufacturers to secure hardware and software throughout their entire life cycle, address vulnerabilities, provide security updates and report vulnerabilities that are actively being exploited. Products without proven compliance may no longer be placed on the market in the EU.
What is the Cyber Resilience Act?
The Cyber Resilience Act closes a gap that has existed in European product law for decades: whilst there were binding requirements and market access controls for the electrical safety of machinery, toys or medical devices, there were none for the cybersecurity of connected products. A router, an industrial control system or an application could be supplied with known vulnerabilities and operated without any commitment to provide updates.
The Regulation addresses precisely this issue. It is a horizontal legislative act, meaning it applies across all sectors to virtually all connected products, and it falls under product legislation: the addressee is not the operator, but the manufacturer. Cybersecurity thus becomes a prerequisite for market access and is linked to the CE marking – the same mechanism through which the EU’s other product requirements are enforced.
Two fundamental principles shape the text. Firstly, ‘security by design’ and ‘security by default’: security must be incorporated into the design and development stages, and the default configuration must be the secure one, not the convenient one. Secondly, lifecycle responsibility: the obligation does not end with the sale, but extends over a defined period of support with security updates. The second point is the innovation with the greater economic implications, as it requires ongoing processes rather than a one-off test.
When did the Cyber Resilience Act come into force?
The Cyber Resilience Act came into force at the end of 2024 and is being implemented in stages, with full applicability only taking effect after a three-year transition period.
| Date | What applies |
| Entry into force (December 2024) | Start of the transition periods; no immediate obligations for manufacturers as yet |
| 18 Months (June 2026) | Regulations concerning conformity assessment bodies and their designation |
| 21 Months (September 2026) | Reporting obligations for actively exploited vulnerabilities and serious security incidents |
| 36 Months (December 2027) | Full applicability, including all product requirements and conformity assessment |
What is noteworthy about this phased approach is the earlier reporting obligations. They come into force more than a year before the product requirements – meaning that manufacturers must already submit reports whilst their products are not yet formally required to meet the full requirements. Anyone who interprets the transition period as ‘until the end of 2027’ will miss this earlier deadline. As the deadlines are linked to the entry into force of the Regulation and the Commission is continually adopting supplementary legal acts, the current status should be checked before implementation.
To which products does the Cyber Resilience Act apply?
The Cyber Resilience Act applies to products with digital elements – that is, to hardware and software whose intended or reasonably foreseeable use involves a direct or indirect data connection to a device or network. The scope is deliberately broad: it ranges from operating systems, applications and libraries, through routers, cameras and industrial control systems, to connected toys and wearables. It also covers associated remote processing solutions that are necessary for the product to function.
Excluded are products for which sector-specific EU legislation containing cybersecurity requirements already exists – in particular medical devices, motor vehicles, civil aviation and marine equipment. Also excluded are products developed exclusively for national security, defence or the processing of classified information.
A key practical distinction concerns open-source software. It does not fall within the scope of the Regulation as long as it is made available outside the context of a commercial activity; however, anyone who commercially exploits open-source software or integrates it into a product and places it on the market bears full manufacturer responsibility for that product. For organisations that maintain and provide ongoing support for open-source components, the Regulation sets out a separate, significantly lighter set of obligations.
Pure cloud services with no product component, on the other hand, do not generally fall under the Cyber Resilience Act, but are covered by NIS-2 – a distinction that must be carefully drawn on a case-by-case basis for hybrid offerings comprising an app and a backend.
Which product categories does the Cyber Resilience Act distinguish between?
The Cyber Resilience Act classifies products into three risk levels, on which the rigour of the conformity assessment depends.
| Category | Examples | Valuation method |
| Standard products | The vast majority of connected products, such as applications without safety-critical functions | Self-assessment by the manufacturer |
| Key products, Class I | Password managers, browsers, antivirus software, VPNs, identity management, network management, operating systems, home routers, connected toys | Self-assessment where harmonised standards are applied in full; otherwise, involvement of a notified body |
| Key products, Class II | Hypervisors, container runtime environments, firewalls and intrusion detection for industrial applications, tamper-proof microcontrollers | Mandatory involvement of a notified body |
| Critical products | Hardware security modules, smart cards and secure elements, smart meter gateways | Possible additional requirement for European cybersecurity certification |
In practical terms, this means that decisions need to be taken at an early stage: the classification determines the effort involved, the timetable and the costs of market authorisation. As notified bodies are only just being established and their capacity is likely to be limited, classifying their own product portfolio is one of the steps that manufacturers should not delay until shortly before the end of the transition period.
What security requirements does the Cyber Resilience Act set out?
The Cyber Resilience Act sets out key requirements for the product itself, which must be applied following a risk assessment. The key points are:
- Delivery without any known exploitable vulnerabilities at the time of placing on the market
- Secure default configuration, including the ability to reset the product to this state
- Protection against unauthorised access through appropriate authentication and access control mechanisms
- Confidentiality and integrity of stored, transmitted and processed data, in particular through encryption
- Data minimisation: Processing only the data necessary for the purpose
- Availability and resilience against denial-of-service attacks
- Reduction of the attack surface, including the limitation of external interfaces
- Limitation of the impact of incidents through appropriate segregation and isolation mechanisms
- Security-related logging of accesses and changes
- Secure update mechanisms, where possible automatic and with clear user information
It is striking that these requirements are not technically new – they are in line with what established security standards have been recommending for years. What is new is that they are now mandatory. An ISO 27001 management system and an established secure development process already cover a significant proportion of the requirements methodologically; the gap usually lies not in the security technology itself, but in documentation, evidence management and ensuring that security measures are consistently embedded throughout the product’s lifecycle.
What does the Cyber Resilience Act require in relation to the handling of vulnerabilities?
The Cyber Resilience Act requires a continuous process for addressing vulnerabilities throughout the entire support period – the part of the regulation which, experience shows, demands the greatest organisational restructuring from manufacturers. Among other things, the following are mandatory:
A Software Bill of Materials (SBOM) in a machine-readable format, covering at least the top-level components. This is essential for being able to determine, in the event of a newly discovered vulnerability in a library, which of the manufacturer’s own products are affected.
A procedure for the coordinated disclosure of vulnerabilities, including a published contact address for reports, as well as regular testing and reviews of the product. Any vulnerabilities found must be rectified immediately, and security updates must be provided free of charge and separately from functional updates, so that users can install them without any functional changes.
The support period is crucial. It must reflect the expected product lifecycle and, as a general rule, must be at least five years, unless the product’s lifespan is shorter. Furthermore, security updates provided must remain available for a period of several years. Crucially for buyers: the support period must be specified and thus becomes a comparable product feature – similar to a warranty statement. The exact timeframes should be checked on a case-by-case basis against the text of the regulation.
What reporting obligations does the Cyber Resilience Act set out?
The Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and serious security incidents that affect product safety. Reports are submitted in stages via a central platform operated by the European Cybersecurity Agency to the relevant national computer emergency response team and the Agency.
The procedure follows the model now familiar from other EU legislation: an early warning within 24 hours of becoming aware of the issue, a more detailed report within 72 hours, and a final report once the issue has been resolved. In addition, affected users must be informed about the vulnerability or incident and the necessary measures, and, where appropriate, the wider public must also be informed.
In practical terms, this means that manufacturers must have a reporting system that is accessible at all times. Twenty-four hours is not enough time to clarify responsibilities, assessment criteria and access to the reporting platform only once an incident has occurred – particularly as other obligations may apply in parallel, such as those under the GDPR where personal data is affected, or under NIS-2 and DORA for the organisation itself. As an actively exploited vulnerability is often also the entry point for a ransomware attack on customers, the reporting process and crisis communication run concurrently in such situations.
How does the conformity assessment under the Cyber Resilience Act work?
Conformity assessment under the Cyber Resilience Act follows the framework of European product law: the manufacturer carries out a risk assessment, draws up technical documentation, demonstrates compliance with the essential requirements, issues an EU declaration of conformity and affixes the CE marking.
The process involved depends on the product category. For standard products, internal production control is sufficient – that is, a self-assessment without the involvement of third parties. For Class I essential products, self-assessment is possible if the relevant harmonised standards are fully applied; otherwise, a notified body must be involved. For Class II essential products, the involvement of a notified body is always required; for critical products, European cybersecurity certification may also be required.
The reference to harmonised standards is the key practical consideration here. As long as the relevant European standards have not been finalised and listed in the Official Journal, the presumption of conformity – which allows manufacturers to demonstrate compliance in a straightforward manner – does not apply. The status of standardisation is therefore at least as relevant to planning as the deadlines set out in the Regulation itself.
How does the Cyber Resilience Act relate to NIS-2 and DORA?
The Cyber Resilience Act regulates products, whilst NIS-2 and DORA regulate organisations. The legislation is interlinked: operators are required to use secure products, and the CRA ensures that such products are available in the first place.
| Legal act | Recipient | Subject |
| Cyber Resilience Act | Manufacturers, importers, distributors | Cybersecurity of products with digital elements throughout their lifecycle |
| NIS-2-Richtlinie | Key and important organisations in 18 sectors | Risk management, reporting requirements and organisational governance |
| DORA | Financial institutions and their ICT service providers | Digital operational resilience in the financial sector |
| DSGVO | Data controllers and data processors | Protection of personal data, security of processing |
| KI-Verordnung | Providers and operators of AI systems | Cybersecurity requirements can be met through CRA compliance |
For operators, this results in a convenient synergy: in future, some of the requirements that NIS-2 imposes on supplier management can be demonstrated using the manufacturer’s CRA certificates. Conversely, the CE marking does not relieve the operator of their responsibilities – it provides information about the product, not about its secure configuration or its operation.
What does the Cyber Resilience Act mean for procurement and operators?
For operators and procurement bodies, the Cyber Resilience Act is, above all, a tool: it establishes comparable, enforceable product characteristics where, until now, manufacturers’ commitments have varied in their level of binding force. In tenders and supplier evaluations, this allows for specific enquiries regarding:
- Specification of the support period and the availability period for security updates
- Software bill of materials and handling of third-party components
- Procedures for the coordinated disclosure of vulnerabilities, including a reporting contact
- Provision of security updates free of charge and separately from functional updates
- Secure default configuration and documented hardening recommendations
- Classification of the product and the chosen method of conformity assessment
These points are in any case part of supplier management and can be aligned with the contractual requirements of a data processing agreement as well as with the obligations to provide evidence under NIS-2. For operators of critical infrastructure and public authorities, the support period is particularly relevant, as procurement cycles in these sectors are often longer than the standard update commitments offered by the market.
For communications solutions, it is worth reviewing the same set of questions. How long are security updates guaranteed for, how are they delivered, what is the reporting procedure for identified vulnerabilities, and what standard configuration is provided – these are questions that can be clarified before deployment and which, once deployment has taken place, can only be addressed with considerable effort.
What penalties does the Cyber Resilience Act provide for?
The Cyber Resilience Act provides for graduated fines to be imposed by the national market surveillance authorities. For breaches of the essential security requirements, as well as of the obligations regarding vulnerability management and reporting, the fines range up to 15 million euros or 2.5 per cent of global annual turnover, whichever is higher. Lower fines apply for breaches of other obligations and for providing incorrect or incomplete information to authorities and notified bodies.
In practice, the measures under product law are at least as relevant. Market surveillance authorities may prohibit the placing of products on the market, order recalls and have products withdrawn from the market – consequences that directly affect a manufacturer’s sales. Which authorities in Germany will be responsible depends on the national implementation and should be checked against the current state of the law.
Summary: Key points on the Cyber Resilience Act
- The Cyber Resilience Act is Regulation (EU) 2024/2847 and makes cybersecurity a prerequisite for market access for products containing digital elements.
- It applies to manufacturers, not operators; compliance is demonstrated via the CE marking.
- The Regulation will be implemented in stages: Reporting obligations come into force well before the product requirements become fully applicable at the end of 2027.
- Virtually all connected hardware and software products are covered; exceptions include sectors subject to sector-specific regulations and open-source software provided on a non-commercial basis.
- The risk classification into standard products, essential products in Classes I and II, and critical products determines the conformity assessment procedure.
- At the heart of the product requirements are ‘security by design’ and ‘security by default’, as well as the requirement that products be delivered without any known exploitable vulnerabilities.
- A software bill of materials (SBOM), a procedure for the coordinated disclosure of vulnerabilities, and free security updates separate from functional updates are mandatory.
- The support period is generally at least five years and becomes a comparable product characteristic that must be specified.
- Actively exploited vulnerabilities and serious incidents must be reported within 24 and 72 hours, respectively, depending on severity, supplemented by a final report.
- The CRA provides verifiable evidence for procurers and operators – but does not replace the obligation to ensure secure configuration and secure operation.