What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

CRA Toolkit Privacy Policy

Quick Summary

Data Stays Local

Your assessment data is stored in your browser. We don't have access to it.

Anonymous Analytics

We use analytics to improve the site. Data is anonymized and you can opt out.

Optional Email

We only collect your email if you choose to provide it. Never sold.

No Data Selling

We will never sell your personal data to third parties. Ever.

1. Who We Are

CRA Toolkit (cra-toolkit.com) is a free tool designed to help organizations understand and prepare for the EU Cyber Resilience Act (Regulation 2024/2847). We are committed to protecting your privacy and being transparent about our data practices.

Controller: Vritah Technologies LLP, 1196 Heera Garden, Pirangut, Mulshi, Pune, Maharashtra 412115, India. Contact: support@cra-toolkit.com. Full registration details are published in the Imprint.

EU Representative (Article 27 GDPR): Vritah Technologies is in the process of appointing an EU Representative as required by GDPR Article 27; full name and EU address will be published in the Imprint once the appointment is finalised. Until then, EU residents and supervisory authorities may contact us directly at support@cra-toolkit.com.

2. What Data We Collect

Data Stored in Your Browser (localStorage)

The following data is stored locally in your browser and never transmitted to our servers:

Assessment answers - Your responses to the CRA readiness assessment
Compliance tracking - Which requirements you've marked as complete
Preferences - Language, theme, and cookie consent choices

Optionally Provided Data

If you choose to provide it:

Email address - For accessing gated content or receiving updates. Stored securely in our database.
Feedback - When you submit feedback or report errors. May include optional email for follow-up.

Analytics Data

We use two analytics services to understand site usage:

Umami Analytics (consent-based) - Privacy-friendly analytics used only after you explicitly opt in to analytics cookies/settings.
Google Analytics (with consent) - If you accept analytics cookies, we additionally collect more detailed usage data via Google Analytics with IP anonymization enabled.

Analytics data is collected only if you consent via the cookie banner.

3. How We Use Your Data

Improve the toolkit - Analytics help us understand which features are useful and where users struggle
Send updates - If you provided your email, we may send CRA-related updates (you can unsubscribe anytime)
Respond to feedback - If you submitted feedback with an email, we may follow up

4. Cookies

We use the following types of cookies:

Type	Purpose	Consent Required
Essential	Site functionality, language preference, consent choice	No (strictly necessary)
Analytics (Google)	Detailed site usage via Google Analytics	Yes
Analytics (Umami)	Privacy-friendly site analytics when analytics preference is enabled	Yes

5. Third-Party Services

We use the following third-party services:

Umami Analytics - Analytics service loaded only with analytics consent. See: Umami Privacy Policy
Google Analytics - Web analytics (with IP anonymization, consent-based). See: Google Privacy Policy
Vercel - Hosting and analytics. See: Vercel Privacy Policy
Supabase - Database for storing emails and feedback. See: Supabase Privacy Policy
Resend - Email delivery service for transactional/opted-in updates.
Paddle - Merchant of record and payment processor for subscriptions and invoicing.
OpenAI, L.L.C. (GPT-5 Mini API, via OpenRouter, Inc.) - Primary AI inference provider for chatbot responses (United States). Chatbot prompts contain only CRA compliance questions; we do not send your name, email address, or other identifying personal data as part of these prompts. This is a paid commercial API — under OpenAI's API terms, inputs and outputs are not used to train their models by default, and logs are retained for a limited period only. OpenRouter routes the request but does not use commercial-tier traffic for training either. Transfer mechanism: EU Standard Contractual Clauses (2021/914). See OpenAI Privacy Policy and OpenRouter Privacy Policy.
Google LLC (Gemini API — Google AI Studio free tier) - Fallback AI inference provider, used only if the primary GPT-5 Mini provider is unavailable (United States). Important: This fallback tier is the free Google AI Studio tier. Under Google's terms for this tier, prompt content may be reviewed by Google and used to improve their AI models. Transfer mechanism: EU Standard Contractual Clauses (2021/914). See Google Privacy Policy.
Groq, Inc. - Second fallback AI inference provider, free tier (United States). Same prompt-content policy as Google's free tier. Transfer mechanism: EU Standard Contractual Clauses (2021/914).
Mistral AI SAS - Third fallback AI inference provider, free tier (France, within the EEA). Same prompt-content policy as Google's free tier.
Upstash, Inc. - Rate-limiting and cache infrastructure (United States). Only hashed client identifiers are stored. Transfer mechanism: EU Standard Contractual Clauses.

Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and apply supplementary measures including encryption in transit and at rest, in line with the EDPB recommendations following Schrems II. A full list of sub-processors and their transfer mechanisms is available on our Sub-processors page.

6. Lawful Basis for Processing

Consent (Art. 6(1)(a)): analytics, optional product updates, and non-essential tracking.
Contract (Art. 6(1)(b)): account creation, workspace access, and service delivery.
Legitimate interests (Art. 6(1)(f)): service security, abuse prevention, and reliability operations.

7. Your Rights (GDPR)

Under GDPR, you have the following rights:

Right to access - Request a copy of data we hold about you
Right to rectification - Ask us to correct inaccurate data
Right to erasure - Request deletion of your data
Right to data portability - Receive your data in a portable format
Right to object - Object to processing of your data
Right to withdraw consent - Withdraw consent at any time (e.g., via cookie settings)

To exercise any of these rights, please contact us.

You also have the right to lodge a complaint with your local EU/EEA data protection authority.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

HTTPS encryption for all data in transit
Secured database access with encrypted credentials
Sensitive data (assessments) stored locally in your browser, not on our servers
Data minimization - we only collect what we need

9. Data Retention

Browser data - Stored until you clear your browser data
Email addresses - Retained until you request deletion
Analytics data - Retained for 14 months (Google Analytics default)
Feedback - Retained for 2 years for product improvement
Account profile data - retained while your account remains active, then deleted or anonymized within a reasonable period.
Chat usage metadata - retained for quota, abuse prevention, and security operations for a limited period.

10. Children's Privacy

This website is not intended for children under 16. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via a notice on our website. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Us

If you have questions about this privacy policy or your data, please contact us:

Email: support@cra-toolkit.com
Feedback form: Use our contact form