What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

It depends on your architecture. Pure browser-based SaaS is generally not covered by the CRA: Recital (12) excludes cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements, and NIS2 applies instead. The CRA does apply to downloadable components you ship (mobile apps, desktop clients, SDKs, agents) and to cloud backends that are remote data processing solutions of a product with digital elements (Article 3(1)-(2)), such as the cloud service an IoT device cannot work without. For in-scope components, not all 22 CRA requirements apply to every product. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

Compliance Calendar

CRA Timeline

Key dates and deadlines for the Cyber Resilience Act

Next Milestone Critical Deadline

420 days

CRA Fully Applies

December 11, 2027

All products MUST be compliant. Fines start.

Action: Ensure all products meet Annex I requirements with CE marking

Quick Facts

Minimum Support Period 5 years (or product lifetime if less)

Security Update Availability At least 10 years after each update is issued, or the remainder of the support period, whichever is longer

Documentation Retention At least 10 years after placed on market, or the support period, whichever is longer

SBOM Required For all products with digital elements

CRA Timeline

December 10, 2024 Preparation Phase Completed

CRA Enters into Force

The regulation officially becomes EU law.

View Details

Detail: 20 days after publication in Official Journal (Nov 20, 2024).

Action: Begin gap analysis and compliance planning

Reference: Article 71.1

Where to go:

December 11, 2025 Preparation Phase Completed

Technical Descriptions Due

EU defines exactly what products fall into each category.

View Details

Detail: Commission implementing act specifying technical descriptions for Important and Critical product categories.

Action: Review if your product falls under Important/Critical classification

Reference: Article 7.4

Where to go:

June 11, 2026 Transition Phase Completed

Notified Bodies Ready

Third-party auditors available for Class II/Critical products.

View Details

Detail: Conformity assessment body notification provisions apply.

Action: Identify and contact Notified Bodies if third-party assessment required

Reference: Articles 35-51

Where to go:

September 11, 2026 Transition Phase Completed

Vulnerability Reporting Starts

You MUST report exploited vulnerabilities to EU authorities.

View Details

Detail: Mandatory reporting of actively exploited vulnerabilities and severe incidents to ENISA and national CSIRTs.

Action: Set up internal processes for 24h/72h/14-day reporting

Reference: Article 14

Where to go:

Reporting Requirements:

24 hours - Initial notification
72 hours - Detailed vulnerability information
14 days - Corrective measures and final report

September 11, 2028 Full Enforcement

ENISA Technical Trend Report

ENISA publishes its first report on emerging cybersecurity risk trends.

View Details

Detail: ENISA publishes a technical report, based on Article 14/15 notifications received, on emerging trends regarding cybersecurity risks in products with digital elements; a report is due every 24 months thereafter.

Action: Review the report for relevant risk trends in your product category

Reference: Article 17.3

Where to go:

695 days remaining

December 11, 2027 Full Enforcement Critical Deadline

CRA Fully Applies

All products MUST be compliant. Fines start.

View Details

Detail: All essential cybersecurity requirements and conformity assessment procedures apply.

Action: Ensure all products meet Annex I requirements with CE marking

Reference: Article 71.2

Where to go:

Penalties:

Essential requirements: Up to €15M or 2.5% of turnover
Other requirements: Up to €10M or 2% of turnover
Incorrect info: Up to €5M or 1% of turnover

420 days remaining

June 11, 2028 Full Enforcement

Legacy Certificate Deadline

EU type-examination certificates and approval decisions issued before the CRA stop being valid.

View Details

Detail: EU type-examination certificates and approval decisions issued under other Union law before this transitional deadline remain valid only until this date.

Action: Confirm any legacy certificates you rely on remain valid, or complete CRA conformity assessment before this date

Reference: Article 69.1

Where to go:

603 days remaining

December 11, 2030 Review Phase

Commission Evaluation

EU reviews how well the CRA is working.

View Details

Detail: European Commission evaluates and reports on CRA effectiveness and implementation.

Action: Provide feedback to industry associations for EU review

Reference: Article 70.1

Where to go:

↗ ENISA CRA resources

1516 days remaining

Ready to Start Your Compliance Journey?

Use our free assessment tool to understand your CRA obligations.

Start Assessment View Checklist

CRA Fully Applies

Quick Facts

CRA Timeline

CRA Enters into Force

Technical Descriptions Due

Notified Bodies Ready

Vulnerability Reporting Starts

ENISA Technical Trend Report

CRA Fully Applies

Legacy Certificate Deadline

Commission Evaluation

Related: EU Machinery Regulation Timeline

Ready to Start Your Compliance Journey?