What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union. It applies to hardware and software products that can connect to networks or process data. The CRA aims to ensure that manufacturers, importers, and distributors maintain security throughout a product's lifecycle, including vulnerability management, security updates, and transparent communication with users. Full enforcement begins December 11, 2027.

Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

Terms of Service

Last updated: 2026-04-29

1. Parties

These Terms govern your use of CRA Toolkit (the "Service"), operated by Vritah Technologies ("we", "us"). By creating an account or using the Service, you agree to these Terms.

2. The service

CRA Toolkit helps software vendors prepare for the EU Cyber Resilience Act (Regulation (EU) 2024/2847). The Service includes assessments, requirement explorers, document templates, an AI assistant, and (on paid plans) generators for technical files and EU Declarations of Conformity.

The Service is informational tooling, not legal advice. CRA compliance ultimately depends on your product, processes and a competent assessment. We make no warranty that documents produced will be accepted by any specific notified body or market surveillance authority.

3. Accounts

You must be at least 16 years old (or the age of digital consent in your country).
You are responsible for safeguarding your password and for all activity under your account.
You must provide accurate registration information and keep it current.

4. Subscriptions, billing & auto-renewal

Paid plans are billed in advance through Paddle, our Merchant of Record. Subscriptions renew automatically at the end of each billing period (monthly or annual) at the then-current price. You may cancel at any time from your account; cancellation takes effect at the end of the current paid period.

5. EU consumer right of withdrawal (digital services)

If you are an EU consumer, you normally have a 14-day right of withdrawal under Directive 2011/83/EU. By upgrading to a paid plan and using the Service immediately, you expressly request the immediate performance of a digital service and acknowledge that you lose this 14-day right of withdrawal once performance has begun (Art. 16(m) CRD). See our Refund Policy for goodwill refunds outside this rule.

6. Acceptable use

You agree not to: (a) reverse engineer the Service except as permitted by law; (b) use the Service to develop a competing product; (c) submit content that is unlawful, infringing, or contains malware; (d) circumvent rate limits or security controls; (e) use AI features to generate content that violates the EU AI Act, GDPR, or other applicable law.

7. Intellectual property

The Service, including all software, content, templates, and documentation, is owned by Vritah Technologies or its licensors. We grant you a limited, non-exclusive, non-transferable licence to use the Service in accordance with these Terms. Documents you generate from your own input data (e.g., a Declaration of Conformity for your product) belong to you.

8. Service levels & availability

We target 99.5% monthly uptime but provide the Service "as available". Scheduled maintenance and force majeure events are excluded from uptime calculations.

9. Limitation of liability

To the fullest extent permitted by law, our aggregate liability arising out of or in connection with the Service shall not exceed the fees you paid us in the 12 months preceding the event giving rise to the claim. We exclude liability for indirect, consequential, or punitive damages, including lost profits or lost data, except in cases of intent or gross negligence, or where statutory liability cannot be limited (e.g., under the EU Product Liability Directive or for personal injury).

10. Termination

You may terminate at any time by deleting your account. We may suspend or terminate your access if you breach these Terms or for any lawful business reason on 30 days' notice. On termination we will delete your personal data subject to legal retention obligations (see our Privacy Policy).

11. Changes to these Terms

We may update these Terms with at least 30 days' notice by email or in-app banner for material changes. Continued use after the effective date constitutes acceptance.

12. Governing law & jurisdiction

These Terms are governed by the laws of Germany, excluding the UN Convention on Contracts for the International Sale of Goods. Mandatory consumer protections in your country of residence remain unaffected. Disputes shall be brought before the courts having jurisdiction at our registered seat, except where mandatory consumer law provides otherwise.

Any dispute arising from or relating to these Terms that cannot be resolved by good-faith negotiation within 30 days shall be submitted to binding arbitration under the ICC Rules of Arbitration. The seat of arbitration shall be Pune, India. The language of arbitration shall be English. The arbitral award shall be final and binding.

13. Contact

Vritah Technologies - support@cra-toolkit.com. Postal address: see Imprint.

14. Not a conformity assessment

CRA Toolkit is a compliance preparation aid. It is not a notified body, conformity assessment body, or certification authority under Regulation (EU) 2024/2847 or any other EU legislation. Use of the Service — including generation of Technical Files, Declarations of Conformity, or any other document — does not constitute, evidence, or guarantee conformity with the EU Cyber Resilience Act or any harmonised standard. Formal conformity assessment must be carried out by the manufacturer or, where required by Article 32 CRA, by an accredited notified body. Verify all outputs against the official text of Regulation (EU) 2024/2847 at EUR-Lex before relying on them for CE marking or market placement.

15. Business use only

CRA Toolkit is a business-to-business (B2B) service designed for use by legal entities — companies, organisations, and sole traders acting in their professional capacity — subject to obligations under Regulation (EU) 2024/2847 (the Cyber Resilience Act) or related EU legislation.

By subscribing to CRA Toolkit Pro or CRA Toolkit Founding Member, you confirm that you are purchasing in your professional capacity as a duly authorised representative of a business entity, and not as a consumer within the meaning of EU Directive 2011/83/EU on Consumer Rights. The 14-day withdrawal right provided under Directive 2011/83/EU does not apply to subscriptions purchased for professional or business purposes.

If you are purchasing as an individual consumer and not in a business capacity, please contact support@cra-toolkit.com before subscribing.