What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

CRA Penalties: Fines Up to €15M Under Article 64

Why Penalties Matter for Product Teams

The CRA is enforced through national market surveillance authorities (MSAs) in each EU Member State. These authorities have broad powers to audit products, request documentation, order product withdrawals, and impose fines. Penalties apply to economic operators — manufacturers, importers, and distributors — depending on which obligation was breached.

Three Penalty Tiers

CRA fines use the higher of a fixed amount or a percentage of global annual turnover, whichever is greater. This means large companies face proportionally larger fines.

Penalty Tiers Under Article 64

T1

Up to €15,000,000 or 2.5% of Global Annual Turnover

Applies to breaches of the most essential obligations.

What triggers Tier 1 (Article 64(2)):

Non-compliance with essential cybersecurity requirements (Annex I)
Failure to meet manufacturer obligations under Article 13 — including risk assessment, technical documentation, vulnerability handling, and support period obligations
Failure to report an actively exploited vulnerability or severe incident to ENISA and the national CSIRT within 24 hours as required by Article 14
Continuing to make a non-compliant product available after a market surveillance order to stop

Article 64(2) explicitly covers Annex I requirements and both Articles 13 and 14. Failure to report actively exploited vulnerabilities is a Tier 1 offence, not Tier 2.

T2

Up to €10,000,000 or 2% of Global Annual Turnover

Applies to breaches of other manufacturer, importer, and distributor obligations.

What triggers Tier 2 (Article 64(3)):

Non-compliance with CE marking requirements (Articles 30–31)
Failure to draw up or maintain the EU Declaration of Conformity (Article 28)
Non-compliance with conformity assessment procedures (Article 32(1), (2) and (3))
Failure to appoint an authorised representative where required (Article 18)
Failure to comply with importer obligations (Article 19) or distributor obligations (Article 20)
Failure to comply with obligations of open-source software stewards (Article 23) or online marketplace operators (Article 22)

Note: Article 14 reporting (actively exploited vulnerabilities) is a Tier 1 offence — see above. Tier 2 covers Articles 18–23, 28, 30–32 per Article 64(3).

T3

Up to €5,000,000 or 1% of Global Annual Turnover

Applies to providing incorrect, incomplete, or misleading information to authorities.

What triggers Tier 3:

Providing incorrect or misleading information to market surveillance authorities
Providing incomplete documentation in response to an official request
Submitting false declarations (e.g., in the EU Declaration of Conformity)
Falsely claiming harmonised standard conformity or certification

How Fines Are Actually Calculated

Article 64 sets maximum fines. National MSAs have discretion within these ceilings and must consider mitigating and aggravating factors when determining the actual fine amount.

Mitigating Factors (Reduce Fine)

Good faith cooperation with authorities
Prompt corrective action once notified
First-time violation with no prior record
Voluntary disclosure of the issue
SME / microenterprise status (see below)
Limited severity or scope of the violation
No financial gain from the violation

Aggravating Factors (Increase Fine)

Repeated or intentional violations
Refusal to cooperate with authorities
Concealment of non-compliance
High risk to users or critical infrastructure
Large number of users affected
Duration of non-compliance before discovery
Financial gain obtained from the violation

SME and Microenterprise Provisions (Article 64(10))

Article 64(10)(a) provides that administrative fines under Article 64(3)-(9) shall not apply to microenterprises and small enterprises for missing the Article 14(2)(a) or 14(4)(a) reporting deadline — this is a genuine, narrow statutory exemption from that specific fine, not merely a procedural accommodation.

EU law requires national authorities to take into account the economic capacity of the operator when setting fine amounts, which in practice means SMEs typically face lower absolute fines than large enterprises for equivalent violations.

EU SME Definition (for reference)

Microenterprise: <10 employees, ≤€2M turnover or balance sheet total
Small enterprise: <50 employees, ≤€10M turnover or balance sheet total
Medium enterprise: <250 employees, ≤€50M turnover or ≤€43M balance sheet total

Penalties for Open Source Software Stewards

OSS stewards have reduced obligations under CRA (Article 24) and correspondingly reduced penalty exposure. Stewards are subject to:

Article 64(10)(b) exempts OSS stewards from administrative fines under Article 64(3)-(9) entirely — for any infringement of the Regulation (their obligations are set out in Article 24: cybersecurity policy, cooperation with market surveillance authorities, CVD policy).
Stewards are not exempted from the Tier 1 fine under Article 64(2), which covers non-compliance with the Annex I essential requirements and Articles 13/14 — Article 24(3) extends some Article 14 reporting duties to stewards in specific circumstances.

OSS Steward Obligations →

How Non-Compliance Is Discovered

Market surveillance authorities use several mechanisms to identify non-compliant products:

Mkt

Market Sweeps (Article 60)

MSAs can conduct coordinated "sweeps" — simultaneous checks of products in a product category, including purchases under a cover identity — to test compliance with essential requirements. ENISA coordinates joint sweeps across Member States.

Cmp

Complaints From Users or Competitors

Any person — including users, security researchers, or competitors — can report a suspected non-compliant product to the national MSA. Security researcher reports are a common trigger.

Inc

Incidents and Vulnerability Reports

A publicly disclosed vulnerability or security incident can trigger an MSA investigation — especially if the manufacturer failed to report it under Article 14 or failed to patch it promptly.

Doc

Proactive Document Checks

MSAs can request the EU Declaration of Conformity, technical documentation, and SBOM from any manufacturer. Missing, incomplete, or incorrect documentation is itself a Tier 1 or Tier 3 violation.

EU

ICSMS / RAPEX Information Exchange

EU Member States share information about non-compliant products through the ICSMS (Information and Communication System for Market Surveillance) and RAPEX (Rapid Alert System). A finding in one Member State can trigger action in all others.

Enforcement Timeline and Process

When an MSA identifies a potentially non-compliant product, the process typically follows:

1

Initial Assessment

MSA gathers information, may request documentation or testing from the manufacturer/importer.

2

Notification of Concerns

MSA informs the economic operator of the identified concerns and provides an opportunity to respond and take corrective action.

3

Corrective Action Period

Where the risk is not immediate, the operator may be given time to remedy the non-compliance before further action.

4

Formal Enforcement Measures

If non-compliance persists: withdrawal orders, market bans, and/or administrative fines. MSAs notify other Member States via ICSMS.

5

Right of Appeal

Economic operators can challenge MSA decisions through national administrative and judicial channels.

CRA Penalties: Fines, Enforcement, and How Non-Compliance Is Discovered