What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

CRA Declaration of Conformity & CE Marking: Articles 27

Why the Declaration of Conformity Matters

The EU Declaration of Conformity (DoC) is the formal document by which a manufacturer declares that their product meets all applicable requirements of the CRA. Issuing a DoC and affixing the CE marking are mandatory steps before a product with digital elements can be placed on the EU market.

The DoC is not just paperwork

The Declaration of Conformity is a legal document with the manufacturer's name and signature. Not having one, or having a false/inaccurate one, is non-compliance with Article 28 — a Tier 2 offence under Article 64(3) (up to €10M or 2% turnover). Supplying incorrect or misleading information to a notified body or market surveillance authority in reply to a specific request is a separate, narrower Tier 3 offence (up to €5M or 1% turnover) under Article 64(4).

Article 27: Presumption of Conformity

A product is presumed to conform with CRA essential requirements if it complies with relevant harmonised standards published in the Official Journal of the EU, or with common specifications issued by the Commission.

Harmonised Standards

European standards organisations (CEN, CENELEC, ETSI) are developing CRA-specific harmonised standards. When published with a reference in the Official Journal, compliance with these standards creates a presumption that the product meets the corresponding essential requirements.

Status (2026): Most CRA harmonised standards are still in development. ETSI EN 303 645 (IoT baseline) and related standards provide partial coverage.

Standards Tracker →

Common Specifications

Where harmonised standards are absent or insufficient, the European Commission may issue "common specifications" directly. Products complying with these also benefit from presumption of conformity.

Common specifications are expected to fill gaps in standards coverage, particularly for product categories where harmonised standards are slow to develop.

Why Presumption of Conformity Matters for Self-Assessment

For Important Class I products, Module A (self-assessment) is only permissible if you apply harmonised standards covering all essential requirements. Without applicable harmonised standards, Class I products must go to third-party assessment. Presumption of conformity is therefore directly tied to your conformity assessment path.

Article 28: EU Declaration of Conformity — Required Content

The EU Declaration of Conformity must be drawn up by the manufacturer (or authorised representative) and must contain specific information laid out in Annex V of the CRA.

1

Product Identification

Name, type, batch, serial number, or other identifying element of the product. Sufficient to uniquely identify the product or product version.

2

Manufacturer Name and Address

Full name and registered address of the manufacturer. If a non-EU manufacturer, the name and address of the EU authorised representative.

3

Declaration of Sole Responsibility

Statement that the declaration is issued under the sole responsibility of the manufacturer.

4

Object of the Declaration

Clear identification of the product — model name, version numbers, applicable product range.

5

Applicable Legislation

Reference to EU Regulation 2024/2847 (the CRA). If other EU harmonisation legislation also applies, list all applicable directives and regulations.

6

Standards or Common Specifications Applied

References to harmonised standards, common specifications, or other technical specifications used to demonstrate conformity.

7

Notified Body Reference (where applicable)

For Class II or Critical products requiring third-party assessment: name, identification number, and certificate reference from the Notified Body.

8

Signature and Date

Signed and dated by (or on behalf of) the manufacturer. Name and title of the person signing.

Need a Declaration of Conformity template?

Generate DoC Document →

Simplified Declaration of Conformity (Annex VI)

Where space constraints prevent the full DoC from accompanying the product (common for software products, embedded devices, or products with small packaging), manufacturers may use a simplified Declaration of Conformity per Annex VI.

The simplified version contains a short statement that the full DoC is available online, with a URL or other address where it can be obtained. The full DoC must still exist and must be kept available for at least 10 years after the product is placed on the market or for the support period, whichever is longer.

Practical use for software products

Most software products will use the simplified DoC — a statement in the product documentation or website pointing to the full declaration. The full declaration should be published at a stable, permanent URL (e.g., example.com/cra-declaration).

Articles 29–30: CE Marking Rules

The CE marking must be affixed to products once the conformity assessment has been successfully completed and the Declaration of Conformity has been drawn up.

Where to Affix CE Marking

Physical products: On the product itself and on its packaging
Software products: In accompanying documentation, on the website, or in the product interface
Digital products: CE marking in the product or in its documentation is sufficient if physical labelling is not possible

CE Marking Requirements

Must be visible, legible, and indelible (or clearly indicated for digital products)
Minimum height: 5mm (unless product size makes this impractical)
Must not be misleading — only applied after conformity assessment is complete
No other marking that could be confused with CE marking is permitted

Notified Body Identification Number

If a Notified Body was involved in the conformity assessment (Class II or Critical products), the Notified Body's identification number must be affixed alongside the CE marking.

Prohibited Uses of CE Marking

Do not affix CE marking before completing conformity assessment
Do not use CE marking if essential requirements are not met
Do not imply CE marking confers any additional product quality beyond regulatory compliance

Keeping the Declaration Up to Date

The DoC is not a one-time document — it must remain accurate throughout the product's lifetime on the EU market.

Upd

Substantial Modifications

If you make a substantial modification to your product after CE marking (changes that affect compliance with essential requirements, product classification, or conformity assessment results), you must conduct a new conformity assessment and issue a new or amended DoC.

Minor software updates that do not change security characteristics do not require a new DoC. Consult Article 26(2)(d) guidance on "substantial modification" when in doubt.

10y

10-Year Retention Obligation

The DoC and all supporting technical documentation must be kept available to market surveillance authorities for at least 10 years after the product is placed on the market or for the support period, whichever is longer (Article 13(13)).

Req

Providing DoC on Request

Market surveillance authorities can request the full DoC and technical documentation at any time. You must be able to provide these promptly (typically within days of a formal request). Failure to provide is a Tier 1 violation.

EU Declaration of Conformity & CE Marking Under the CRA