What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

OSS Guide

CRA for Open Source Stewards

What foundations and maintainers need to know about the Cyber Resilience Act

Are you an Open Source Steward?

The CRA creates a special category for organizations that support open source projects. If you're a foundation, consortium, or organization that helps maintain open source software — this applies to you.

Examples: Linux Foundation, Apache Software Foundation, Eclipse Foundation, CNCF

What is an Open Source Software Steward?

In Simple Terms:

An organization (not an individual) that helps maintain and support open source projects that businesses use commercially.

Key Points:

Must be a legal entity (not individual contributors)
Provides sustained support for open source development
Projects must be intended for commercial use
Ensures long-term viability of projects

View Legal Definition (Article 3(14))

"'open-source software steward' means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements qualifying as free and open-source software that are intended for commercial activities, and that ensures the viability of those products"

Does CRA Apply to Your Open Source Work?

Quick Decision Flow

Is the software used commercially?

YES → CRA may apply NO → Generally exempt

Is the software monetized by the developer?

YES → Developer is a Manufacturer NO → Continue to next question

Is there a legal entity providing sustained support?

YES → Entity may be an OSS Steward NO → Generally exempt

Who is NOT covered:

Individual open source contributors
Volunteer maintainers with no commercial activity
Educational or research projects
Internal-use only development

OSS Steward Obligations

What you MUST do under the CRA

Article 24.1 Easy

Establish Cybersecurity Policy

Create a security.md file and vulnerability handling process

View Details

Document and make available a cybersecurity policy to facilitate secure development

Actions:

Create SECURITY.md in project repositories
Define vulnerability disclosure process
Document secure development practices

⏰ Deadline: By Dec 11, 2027

Articles 14, 15 Medium

Report Vulnerabilities

Report actively exploited vulnerabilities to ENISA and national CSIRTs

View Details

Notify authorities of actively exploited vulnerabilities through the EU Single Reporting Platform

⏱️ Timeline:

24 hours - Initial notification
72 hours - Detailed information
14 days - Corrective measures

Actions:

Prepare EU Login and reporting roles; register with the SRP when a report is needed
Set up monitoring for exploit reports
Create internal escalation procedures

⏰ Deadline: By Sept 11, 2026

Article 24.2 Easy

Cooperate with Authorities

Work with Market Surveillance Authorities when asked

View Details

Cooperate with market surveillance authorities and provide documentation upon request

Actions:

Designate a contact person for authority requests
Maintain compliance documentation
Respond to requests within reasonable timeframes

⏰ Deadline: Ongoing

Best practice (not a specific CRA obligation) Medium

Due Diligence Process

Take reasonable care about security of supported projects

View Details

Recommended practice, not a distinct legal duty under Article 24 (which has only 3 paragraphs: cybersecurity policy, cooperation with authorities, and limited Article 14 reporting) — exercising general due diligence on supported projects still supports the cybersecurity-policy obligation above

Actions:

Regular security audits of key projects
Track dependencies and known vulnerabilities
Support security improvements in projects

⏰ Deadline: Ongoing

What Stewards Don't Have to Do

Unlike manufacturers, OSS Stewards have lighter obligations

CE Marking

Stewards cannot and do not need to apply CE marking to projects

Full Annex I Compliance

Stewards don't need to ensure products meet all security requirements

Conformity Assessment

No third-party audits required for stewards

Product Liability

Stewards are not liable for products like manufacturers are

Steward vs Manufacturer: Liability Shield

Article 24 gives stewards lighter obligations than manufacturers. This comparison clarifies what is and is not required.

Steward: What you still must do

Maintain a documented cybersecurity policy for stewardship activities.
Run a coordinated vulnerability disclosure intake and triage process.
Cooperate with market surveillance authorities and ENISA where required.
Report severe incidents affecting steward-operated development infrastructure.

Steward: What you do not need to do

No CE marking for open-source components you steward.
No Annex VII technical documentation package as a manufacturer.
No conformity assessment module execution (A, B+C, H) as product manufacturer.
No manufacturer Declaration of Conformity obligations for third-party products.

Manufacturer obligations (for contrast)

Meet all Annex I essential cybersecurity requirements.
Complete applicable conformity assessment pathway.
Issue Declaration of Conformity and affix CE marking.
Maintain post-market vulnerability handling and mandatory reporting obligations.

Liability shield conditions

The lighter-touch regime is tied to your steward role. If you commercially place products with digital elements on the EU market, manufacturer obligations apply for those products.

Top 10 Actions for Stewards

Based on Linux Foundation guidance

Confirm Legal Entity

Ensure your foundation's legal entity status is clearly documented on website

Identify Projects

List which projects under your stewardship are intended for commercial use

Establish Security Policy

Create or update SECURITY.md with vulnerability handling process

Set Up Exploit Detection

Monitor for reports of actively exploited vulnerabilities in your projects

Prepare SRP Access

Set up EU Login and reporting roles; ENISA advises registering when a specific notification is needed

Leverage Security Tools

Use foundation security tools (OpenSSF Scorecard, Dependabot, etc.)

Enable SBOM Generation

Offer SBOM generation capabilities to downstream users

Perform Component Diligence

Document due diligence on major dependencies

Support Critical Upstreams

Help secure critical upstream dependencies your projects rely on

Stay Informed

Follow CRA implementation updates and guidance

Penalties for Stewards

Good news: OSS Stewards face no administrative fines under the CRA

• Article 64(10)(b) exempts OSS stewards from administrative fines for any infringement of the Regulation — with no exception
• Focus is on cooperation and correction, not punishment
• Market surveillance authorities can still require corrective action

Reference: Article 64(10)(b); Recital 120

Frequently Asked Questions

I'm a solo maintainer. Does CRA apply to me?

Probably not. CRA targets commercial activities and legal entities, not individual volunteer contributors.

Our foundation hosts many projects. Are all of them covered?

Only projects intended for commercial activities and where the foundation provides sustained support for viability.

What counts as 'commercial activity'?

Charging for the software, providing paid support, monetizing through services, or integration into commercial products by downstream users.

Can we still use 'as-is' disclaimers?

Yes, but for projects under stewardship, you still have the lighter obligations even with disclaimers.

Ready to Start Your Compliance Journey?

Use our free assessment tool to understand your CRA obligations.

Start Assessment View Timeline

Are you an Open Source Steward?

What is an Open Source Software Steward?

In Simple Terms:

Key Points:

Does CRA Apply to Your Open Source Work?

Quick Decision Flow

Who is NOT covered:

OSS Steward Obligations

Establish Cybersecurity Policy

Report Vulnerabilities

Cooperate with Authorities

Due Diligence Process

What Stewards Don't Have to Do

CE Marking

Full Annex I Compliance

Conformity Assessment

Product Liability

Steward vs Manufacturer: Liability Shield

Steward: What you still must do

Steward: What you do not need to do

Manufacturer obligations (for contrast)

Liability shield conditions

Top 10 Actions for Stewards

Confirm Legal Entity

Identify Projects

Establish Security Policy

Set Up Exploit Detection

Prepare SRP Access

Leverage Security Tools

Enable SBOM Generation

Perform Component Diligence

Support Critical Upstreams

Stay Informed

Penalties for Stewards

Frequently Asked Questions

Resources

Linux Foundation CRA Playbook

OpenSSF Global Cyber Policy WG

ENISA Reporting Platform

Ready to Start Your Compliance Journey?