Does the CRA apply to SaaS (Software as a Service) products?

Yes, the CRA applies to most SaaS products. The regulation covers 'products with digital elements' which includes software that processes data or connects to networks. Cloud-based SaaS applications fall under this definition if they are sold or made available to EU customers. However, not all 22 CRA requirements apply to every SaaS product—typically 8-12 requirements apply to cloud-only B2B SaaS, while IoT products may need to comply with all 22. Use the free CRA Compliance Toolkit at cra-toolkit.com to determine which specific requirements apply to your product.

What are the main CRA requirements for software products?

The main CRA requirements for software products include: 1) Secure by Design (Article 10.1) - integrating security throughout development, 2) Secure by Default (Article 10.2) - shipping with secure default configurations, 3) Software Bill of Materials/SBOM (Article 10.5) - maintaining a list of all software components, 4) Vulnerability Handling (Article 13) - having a process to receive and address security vulnerabilities, 5) Security Updates (Article 10.4) - providing security updates for at least 5 years or the product's expected lifetime. Additional requirements may apply based on your specific product type and classification.

When does CRA enforcement begin and what are the key deadlines?

The CRA enforcement happens in phases: 1) December 10, 2024 - CRA enters into force, 2) September 11, 2026 - Conformity assessment bodies must be designated, 3) September 11, 2026 - Vulnerability and incident reporting obligations begin, 4) December 11, 2027 - Full enforcement of all requirements. Organizations selling products with digital elements in the EU should begin compliance preparations now to meet these deadlines.

What is an SBOM and why does CRA require it?

An SBOM (Software Bill of Materials) is a comprehensive list of all software components, libraries, and dependencies used in a product—like an ingredients list for software. CRA Article 10.5 requires manufacturers to maintain SBOMs because: 1) It enables rapid identification of affected products when vulnerabilities are discovered (e.g., Log4j), 2) It provides transparency about third-party components and their security status, 3) It supports vulnerability management and incident response. Free tools like CycloneDX, Syft, and Trivy can generate SBOMs automatically from your codebase.

How much does CRA compliance cost?

CRA compliance costs vary significantly: Hiring consultants typically costs €8,000-€15,000 for initial assessment and €20,000-€50,000+ for full implementation support. However, DIY compliance is possible at minimal cost using free, open-source tools: CycloneDX for SBOM generation, OWASP Dependency-Track for vulnerability monitoring, Trivy for container scanning, and Semgrep for static analysis. The free CRA Compliance Toolkit at cra-toolkit.com helps identify which requirements apply to your product, potentially saving thousands in unnecessary consultant fees. Additionally, EU SMEs can apply for up to €30,000 in grants through the SECURE/Secure4sme program (50% co-financing).

Is my US-based company affected by the CRA?

Yes, if your US-based company sells products with digital elements to customers in the European Union, the CRA applies to you. The CRA has extraterritorial reach—it applies based on where products are sold, not where the company is based. If you place products on the EU market (even through distributors or resellers), you must comply with CRA requirements. This is similar to how GDPR applies to non-EU companies that process EU residents' data.

What products are exempt from CRA?

Several categories are exempt from CRA: 1) Internal tools not placed on the market, 2) Custom software developed for a single client, 3) Products already regulated under other EU frameworks (medical devices, vehicles, aviation), 4) National security and military products, 5) Open-source software developed non-commercially by individuals or non-profit foundations (though commercial entities using open-source remain liable). SaaS products serving only internal company use would not be in scope, but any product offered to external EU customers likely falls under CRA.

What is the difference between CRA and NIS2?

CRA and NIS2 are complementary EU regulations with different focuses: CRA (Cyber Resilience Act) focuses on PRODUCT security—ensuring hardware and software products sold in the EU are secure by design. NIS2 (Network and Information Security Directive 2) focuses on ORGANIZATIONAL security—requiring essential and important entities to implement cybersecurity measures and report incidents. A company might need to comply with both: NIS2 for their organizational security practices, and CRA for any products they manufacture and sell. CRA has specific technical requirements (SBOM, vulnerability handling), while NIS2 focuses on governance, risk management, and incident reporting.

How do I check if CRA applies to my product?

To check if CRA applies to your product, ask these questions: 1) Do you sell or make your product available in the EU market? 2) Is your product software or hardware that processes data or connects to networks? 3) Are you the manufacturer (creator/seller) of the product? If you answered YES to all three, CRA likely applies. The free CRA Compliance Toolkit at cra-toolkit.com provides a 5-minute assessment that determines exactly which of the 22 CRA requirements apply to your specific product type, saving you hours of research through the 200+ page regulation.

What are the CRA penalties for non-compliance?

CRA penalties can be severe: up to €15 million or 2.5% of global annual turnover (whichever is higher) for violations of essential cybersecurity requirements. For less severe infringements, fines can reach €10 million or 2% of turnover. Providing misleading information to authorities can result in fines up to €5 million or 1% of turnover. Additionally, non-compliant products can be withdrawn from the EU market entirely, resulting in significant revenue loss beyond the fine itself.

What is a Software Bill of Materials (SBOM) and how do I create one for CRA?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, and dependencies in your product — like an ingredients list for software. CRA Article 10.5 requires manufacturers to create and maintain SBOMs. You can generate one for free using tools like CycloneDX CLI, Syft, or Trivy. The SBOM should include component names, versions, suppliers, and known vulnerabilities. Integrate SBOM generation into your CI/CD pipeline for automatic updates. The free CRA Compliance Toolkit at cra-toolkit.com/cra-sbom-requirements provides detailed guidance.

Does the CRA apply to open-source software?

It depends. Non-commercial open-source software developed by individuals or non-profit foundations is generally exempt from CRA. However, commercial entities that use, integrate, or distribute open-source software in their products remain fully liable under CRA for those products. Additionally, the CRA introduces a new category called open-source software stewards (Article 24) — organizations that systematically support open-source projects used commercially. Stewards have reduced obligations focused on cybersecurity policies and cooperation with authorities, but they are not exempt entirely. Learn more at cra-toolkit.com/cra-for-stewards.

How does CRA affect companies outside the EU?

The CRA has extraterritorial reach, similar to GDPR. If your company — regardless of where it is headquartered (US, UK, India, etc.) — sells or makes available products with digital elements to customers in the EU market, you must comply with CRA requirements. This applies whether you sell directly or through distributors, resellers, or app stores. Companies outside the EU should designate an authorized representative within the EU and begin compliance preparations well before the December 2027 full enforcement deadline. Use the free assessment at cra-toolkit.com/does-cra-apply-to-me to check your obligations.

Article 14 reporting obligations apply since 11 September 2026

Does the CRA apply to your product?

Find out in 6 minutes. Get your risk classification, see which requirements apply, and get a clear action plan — free, no signup required.

Check My Product See how it works

6 min classification

22 requirements mapped

436 days to full application See timeline →

cra-toolkit.com/explorer

8/22 Completed

Risk-Based Design

Annex I, Part I, (1)

Completed

No Known Vulnerabilities

Annex I, Part I, (2)(a)

In Progress

Secure by Default

Annex I, Part I, (2)(b)

Not Started

SBOM - Software Bill of Materials

Annex I, Part II, (1)

Not Started

Based on EU Regulation 2024/2847

Official EU Source

How It Works

From zero to CRA-ready in 3 steps

AI Copilot

Ask the CRA. Get answers that point to the Articles.

CRA Copilot answers your compliance questions in plain language — deadlines, SBOMs, reporting, technical files — drawing on the text of Regulation (EU) 2024/2847.

Grounded in the regulation Answers draw on the official CRA text and point you to the Articles and Annexes behind them.
Knows your product Complete the assessment and answers take your classification and open requirements into account.
Try it free 10 free questions a month with a free account. Unlimited with Pro (fair use applies).

Ask the Copilot See Pro plans

AI may be inaccurate — not legal advice.

When do I have to report an actively exploited vulnerability?

Notify the coordinating CSIRT and ENISA at the same time, via the single reporting platform: Art. 14(1)

24 hours Early warning, within 24 hours of becoming aware of it Art. 14(2)(a)
72 hours Vulnerability notification, within 72 hours of becoming aware of it Art. 14(2)(b)
14 days Final report, no later than 14 days after a corrective or mitigating measure is available Art. 14(2)(c)

These obligations apply from 11 September 2026. Art. 71(2)

Ask anything about CRA compliance…

Who Is This For?

Pick your role for guidance tailored to your CRA obligations

Software Manufacturer

Building apps, SaaS, or desktop software sold to EU customers

IoT / Hardware

Connected devices, smart home products, or embedded systems

Startup

Early-stage company wondering what minimum compliance looks like

CTO / Security Lead

Running vulnerability handling and security-by-design across the product portfolio

Open Source Steward

Maintaining an OSS project incorporated into commercial products

Importer / Distributor

Reselling or distributing products made by another manufacturer

Pro — Core deliverable

Generate your CRA Technical File package

The document your auditor, notified body, and customers ask for — built from your assessment in minutes, not weeks.

Technical File (Annex VII compliant)
Declaration of Conformity
Coordinated Vulnerability Disclosure policy
SBOM generation and gap report

Generate Technical File → See Pro pricing

Free · Open source

Scan your repository against the CRA from the terminal

cra-check reads your repository and shows what the Cyber Resilience Act (Annex I) expects and what your files do or do not evidence.

Runs locally and read-only: no network access, no telemetry
Checks SBOM, disclosure policy and reporting contact from repository files
Everything else is marked "needs a human" — never a compliance verdict

A preparation aid, not legal advice or a conformity assessment. Requires Node 20+.

View on npm →

Terminal

$ npx cra-check

Simple, Transparent Pricing

Start free. Upgrade when you need more.

Free

EUR 0

CRA Assessment
Requirements Explorer
Security.txt Generator
VDP Template Download
Limited AI Chatbot

Get Started Free

Founding Member Pricing

Founding Member

EUR 29 /month

Price locked forever — limited to the first 20 customers

Everything in Free
Saved Workspaces
CRA Document Generator
SBOM Analysis
Unlimited AI Chatbot (fair use)
PDF/Word Exports

View Pricing →

Latest Guidance

View All Articles CRA guides by industry, role & country →

Guide 12 min

CRA Compliance Step-by-Step: The Complete 2026 Roadmap

A practical 8-step roadmap to achieve EU Cyber Resilience Act compliance. From initial assessment to CE markin...

Read →

Industry 10 min

CRA for SaaS Companies: What You Actually Need to Do

Pure browser-based SaaS is generally exempt from CRA under Recital (12). Learn when CRA does apply to cloud pr...

Read →

Tools 8 min

SBOM Tools Comparison 2026: CycloneDX vs SPDX vs Syft vs Trivy

Hands-on comparison of the top SBOM generation tools for CRA compliance. Which format and tool should you choo...

Read →

Common Questions

Browse Full FAQ

What is the EU Cyber Resilience Act (CRA)?

The EU Cyber Resilience Act (CRA), officially EU Regulation 2024/2847, is a comprehensive EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the European Union.

Key points:

Applies to hardware and software products that connect to networks or process data
Covers manufacturers, importers, and distributors
Requires security throughout a product's lifecycle
Includes vulnerability management, security updates, and transparent communication
Full enforcement begins December 11, 2027

Does the CRA apply to SaaS products?

It depends on your architecture. CRA Recital (12) explicitly excludes "cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements" — so pure browser-based SaaS is generally NOT covered by CRA. NIS2 applies to such services instead (for organizations of sufficient size).

CRA does apply to:

Downloadable components — mobile apps, desktop clients, SDKs, agents
Cloud backends that support a product with digital elements (e.g., the cloud service behind an IoT device)

For in-scope components, typically 8-12 of 22 requirements apply. The free CRA assessment at cra-toolkit.com can determine your specific situation.

Source: EU Regulation 2024/2847, Recital (12)

When does CRA enforcement begin?

CRA enforcement happens in phases:

November 20, 2024 - CRA published in Official Journal
December 10, 2024 - CRA enters into force
June 11, 2026 - Conformity assessment body notification requirements apply (Chapter IV)
September 11, 2026 - Vulnerability and incident reporting obligations begin (Article 14)
December 11, 2027 - Full enforcement of all requirements

Organizations should begin compliance preparations now to meet these deadlines.

See the full CRA timeline →

Browse Full FAQ

Ready to Start?

Take our 6-minute assessment to discover your product classification and get personalized compliance recommendations.

Start Assessment

Does the CRA apply to your product?

How It Works

Take the Assessment

Review Your Requirements

Track & Export

Ask the CRA. Get answers that point to the Articles.

Who Is This For?

Generate your CRA Technical File package

Scan your repository against the CRA from the terminal

Simple, Transparent Pricing

Latest Guidance

Common Questions

Ready to Start?