What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

Related EU Regulation Last updated: September 5, 2026

EU Machinery Regulation 2023/1230

The new EU Machinery Regulation introduces cybersecurity requirements for machinery with digital elements. Learn how it intersects with CRA and what it means for industrial IoT, robotics, and smart manufacturing.

How This Relates to CRA

The EU Machinery Regulation 2023/1230 and the Cyber Resilience Act (CRA) have overlapping cybersecurity requirements. If your product is both "machinery" AND a "product with digital elements," you may need to comply with both regulations. Per Article 9 of the Machinery Regulation, where requirements overlap, the more specific regulation applies.

Check if CRA applies to your product →

What is the EU Machinery Regulation?

Regulation (EU) 2023/1230 is the new EU legislation governing health and safety requirements for machinery, related products, and partly completed machinery placed on the EU market. It replaces the old Machinery Directive 2006/42/EC and becomes mandatory on 20 January 2027.

Machinery

Assemblies with drive systems, linked parts, at least one moving part, joined for a specific application

Safety Components

Physical or digital components (including software) that fulfill a safety function

Partly Completed Machinery

Assemblies intended to be incorporated into other machinery to form complete systems

Key Dates

29 June 2023

Published - Regulation (EU) 2023/1230 published in Official Journal

19 July 2023

Entry into Force - Regulation enters into force

20 January 2027

Applies - Full application date. Directive 2006/42/EC repealed.

Same as CRA!

Note that the Machinery Regulation application date (20 Jan 2027) is close to the CRA deadline (11 Dec 2027). If both apply to your product, you'll need to prepare for two major compliance milestones.

Cybersecurity Requirements (New in 2023/1230)

The new Machinery Regulation introduces mandatory cybersecurity requirements for the first time. These are found in Annex III, Sections 1.1.9 and 1.2.1.

1.1.9

Protection Against Corruption

Hardware components transmitting signals for safety-critical software must be protected against corruption
Software and data critical for compliance must be identified and adequately protected
Machinery must collect evidence of legitimate or illegitimate interventions
Must identify installed software necessary for safe operation

1.2.1

Safety and Reliability of Control Systems

Control systems must withstand malicious attempts from third parties
Faults in hardware or logic must not lead to hazardous situations
Must maintain a 5-year tracing log of interventions and safety software versions
For AI/ML systems: 1-year logging of safety-related decision-making
Wireless control failures must not lead to hazardous situations

AI and Machine Learning Systems

The Machinery Regulation has specific requirements for self-evolving behavior and machine learning systems that ensure safety functions.

Annex I Part A - Mandatory Third-Party Assessment

The following AI/ML products require third-party conformity assessment:

Safety components with fully or partially self-evolving behavior using machine learning
Machinery with embedded AI/ML systems ensuring safety functions (if not already assessed independently)

Additional Requirements for AI/ML Control Systems (Section 1.2.1)

Must not cause machinery to perform actions beyond its defined task and movement space
Must enable recording of safety-related decision-making data for 1 year
Must be possible to correct the machinery at all times to maintain inherent safety
No modifications to safety settings during learning phases that could lead to hazardous situations

CRA + Machinery Regulation: When Both Apply

If your product is BOTH machinery/related product AND a product with digital elements, you need to understand how the two regulations interact.

Article 9

Specific regulation takes precedence

Where risks are covered by more specific EU harmonization legislation, that legislation applies instead of the Machinery Regulation for those specific risks.

Article 20(9)

Cybersecurity certification presumption

Products certified under Regulation (EU) 2019/881 (Cybersecurity Act) are presumed compliant with sections 1.1.9 and 1.2.1 if the certificate covers those requirements.

Products That May Need Both

Industrial IoT

Connected manufacturing equipment
Smart sensors with safety functions
Industrial robots with network connectivity

Smart Machinery

CNC machines with remote access
Automated guided vehicles (AGVs)
Collaborative robots (cobots)

Conformity Assessment Procedures

The Machinery Regulation has a tiered conformity assessment system based on risk:

Not in Annex I

Self-Assessment (Module A)

Internal production control. No third-party involvement required.

Annex I Part B

Self-Assessment OR Third-Party

Module A (if using harmonized standards) OR Module B+C, H, or G with notified body.

Annex I Part A

Mandatory Third-Party Assessment

Module B+C, H, or G with notified body. Includes AI/ML safety components.

What's New vs. Directive 2006/42/EC

New Requirements

Cybersecurity - Sections 1.1.9 and 1.2.1
AI/ML provisions - Self-evolving behavior
Software as safety component
Digital instructions allowed
Substantial modification definition

Key Changes

Directive → Regulation (directly applicable)
Updated product categories in Annex I
Clearer economic operator obligations
Digital declarations of conformity
Extended documentation requirements

Common Industry Challenges

Many companies are facing significant practical challenges with the new regulation:

⚠️

Compliance Complexity

Stricter safety, design and risk assessment requirements including cybersecurity, AI and digital documentation

👥

Resource Shortages

Not enough personnel, time or budget to analyze, revise designs, and update documentation before 2027

📅

Tight Deadlines

Short transition period given the volume of changes required for January 2027

📜

Harmonised Standards Gap

Many harmonised European standards (hENs) may not be revised or available in time

📄

Digital Documentation

New requirements for digital operating instructions accessible for 10+ years

🔗

Regulatory Overlap

Must align with CRA, NIS2, and other EU laws with overlapping requirements

Does Your Product Need CRA Compliance?

If your machinery includes digital elements with network connectivity, you may also need to comply with the Cyber Resilience Act. Use our free assessment tool to find out.

Start CRA Assessment Learn About CRA