What is the Cyber Resilience Act?
The CRA is a landmark EU regulation that introduces mandatory cybersecurity rules for hardware and software products marketed in the European Union. Its goal is to ensure digital products are secure across their entire lifecycle.
Who Does it Affect?
Manufacturers, importers, and distributors of "products with digital elements" (PDEs). If your software or hardware connects to another device or network, it's likely covered.
Core Obligations
- Secure by Design & Default: Security integrated from day one.
- Vulnerability Handling: Handle vulnerabilities for the support period: at least 5 years, or the expected use time if that is shorter (Article 13(8)).
- Transparency: Draw up a Software Bill of Materials (SBOM) and provide clear user information and instructions (Annex II).
- Incident Reporting: Notify actively exploited vulnerabilities and severe incidents to the CSIRT and ENISA, starting with an early warning within 24 hours (applies since 11 September 2026).
Use our CRA Assessment tool to see exactly how your product is classified.
Get the CRA deadline calendar
A one-page PDF showing every CRA date that matters for your product team. Free — no spam, unsubscribe anytime.
Related articles
Ready to Take Action?
Start your CRA compliance journey with our free assessment tool.