The Cyber Resilience Act (CRA) is the EU's first horizontal law on the cybersecurity of products. It applies to products with digital elements: hardware and software, including components sold separately, whose use includes a data connection to a device or network. A smart speaker, a connected e-bike display, a baby monitor, a router and a mobile app can all be in scope.
The CRA makes cybersecurity a condition for selling in the EU, in the same way as electrical or toy safety. Products must meet the essential cybersecurity requirements in Annex I, carry the CE marking and come with an EU declaration of conformity.
Key dates
- 10 December 2024: the Regulation entered into force.
- 11 June 2026: rules on conformity assessment bodies (Chapter IV) apply.
- 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents (Article 14).
- 11 December 2027: all other obligations apply.
Products placed on the market before 11 December 2027 only need to meet the requirements if they are substantially modified after that date. The reporting duty is different: it covers every in-scope product, whenever it was placed on the market.
What manufacturers must do
- Secure by design (Article 13(1) to (2)). Assess the cybersecurity risks of the product and design, develop and produce it to meet Annex I, Part I. That includes no known exploitable vulnerabilities at launch and a secure default configuration.
- Handle vulnerabilities (Annex I, Part II). Identify and document components, draw up a software bill of materials (SBOM) covering at least the top-level dependencies, fix vulnerabilities without delay and provide security updates free of charge.
- Set a support period (Article 13(8)). At least five years, or shorter only if the product is expected to be in use for less than five years. The end date, at least the month and year, must be clear at the time of purchase (Article 13(19)).
- Report to ENISA (Article 14). Through the single reporting platform run by ENISA: an early warning within 24 hours, a notification within 72 hours and a final report later.
- Inform users (Annex II). Instructions must include a contact point for reporting vulnerabilities, the type of security support offered and the end date of the support period.
- Keep records. Technical documentation and the declaration of conformity stay available for at least 10 years after the product is placed on the market, or for the support period if longer.
Important and critical products
Most products can be self-assessed by the manufacturer (internal control, module A). Products listed in Annex III need more:
- Important products, class I, such as password managers, VPNs, operating systems, routers, smart home virtual assistants, smart door locks, security cameras, baby monitors, connected toys with social or location features, and some wearables. Self-assessment is only allowed when the manufacturer fully applies harmonised standards or certification schemes.
- Important products, class II, such as firewalls, hypervisors and tamper-resistant microcontrollers, always need third-party assessment by a notified body or a European cybersecurity certification scheme.
- Critical products (Annex IV), such as smartcards and smart meter gateways, may be required by delegated act to obtain a European cybersecurity certificate; otherwise they follow the class II procedures.
Importers and distributors have their own duties, and a manufacturer outside the EU can appoint an authorised representative under Article 18.
The CRA and product information
The CRA does not create a Digital Product Passport. It does require more information to reach buyers and users: the end of the support period at the time of purchase, a contact point for vulnerabilities, secure-use instructions and the address of the declaration of conformity. Where instructions are online, they must stay available for at least 10 years or the support period, whichever is longer. Many brands will publish this alongside other product information on a page linked from the product or its packaging.
How to prepare
- Check scope. List every product with a data connection, including apps and cloud services that the product needs to work.
- Classify each product as default, important (class I or II) or critical, to know which conformity assessment applies.
- Set up vulnerability handling now: a public contact point, a coordinated disclosure policy and an internal process that can meet the 24-hour and 72-hour deadlines.
- Build SBOMs into your release process for every firmware and software version.
- Decide the support period for each product and plan how buyers will see the end date.
- Plan how to reach users with security updates and advisories once products are sold.
How Veribl helps
Veribl gives every connected product its own page behind the QR code, with manuals, guides and support in one place. Owners register their product there, and owner notice flows let you reach every registered owner with security and firmware update notices.
See Veribl product registrationOfficial sources
Frequently asked questions
When does the Cyber Resilience Act apply?
The CRA entered into force on 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, the rules on notified bodies from 11 June 2026, and all other obligations from 11 December 2027.
What products does the Cyber Resilience Act cover?
It covers products with digital elements, meaning hardware and software products and their remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Examples include smart home devices, connected toys, wearables, routers, apps and operating systems. Products covered by the medical device, in vitro diagnostic and vehicle type-approval regulations are excluded.
How long must manufacturers provide security updates under the CRA?
Manufacturers set a support period that reflects how long the product is expected to be in use. It must be at least five years, unless the product is expected to be in use for less than five years. The end date, at least the month and year, must be clear at the time of purchase (Article 13(19)).
What are the CRA reporting obligations?
From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a fix is available for vulnerabilities, or within one month for incidents.
Does the Cyber Resilience Act require an SBOM?
Yes. Annex I, Part II requires manufacturers to identify and document the components and vulnerabilities in their products, including by drawing up a software bill of materials in a commonly used, machine-readable format covering at least the top-level dependencies. The SBOM goes into the technical documentation; it does not have to be published.
Do products already on the market need to comply with the CRA?
Products placed on the market before 11 December 2027 only fall under the CRA's requirements if they are substantially modified after that date. The reporting obligations in Article 14 are the exception: they apply to all in-scope products, including those placed on the market earlier.
Last reviewed