The EU Cyber Resilience Act: A Guide for Device Manufacturers
The CRA is EU law for every product with digital elements sold in the EU, and the first obligation is already live. Since 11 September 2026, manufacturers have had 24 hours to send an early warning about an actively exploited vulnerability through ENISA's Single Reporting Platform. Everything else applies from 11 December 2027. This guide splits the regulation into nine chapters. Start with the one in front of you.
CRA timeline: where things stand today
Five dates run from entry into force to full application. Reporting is the only obligation already binding, and the harmonised standards that define the lighter conformity route are still being drafted.
Entry into force. The regulation becomes law. The transition clock starts.
Notified body rules apply. Member States can designate conformity assessment bodies.
Article 14 reporting (in force now). Actively exploited vulnerabilities and severe incidents go to ENISA's Single Reporting Platform.
Harmonised standards due. Revised deadlines under a draft Commission amendment. None cited in the Official Journal yet.
Full application. Essential requirements, technical documentation and CE marking apply to every product placed on the market.
Does the CRA apply to your product?
Three questions settle scope. Where you're based doesn't enter into it: a manufacturer in the US, UK or Asia selling into the EU is covered the same as one in Munich.
- 01
Does the product contain hardware or software with a direct or indirect data connection to a device or network?
No → Out of scope.
- 02
Is it made available on the EU market in the course of a commercial activity?
No → Out of scope, unless a customer or distributor sells it into the EU.
- 03
Is it fully covered by a sector law the CRA excludes: medical devices (MDR, IVDR), type-approved vehicles, civil aviation, marine equipment, or products built only for national security or defence?
Yes → Excluded. Your sector rules apply. Components you sell separately may still be in scope.
The CRA applies. Next, classify the product as default, important Class I, important Class II or critical. The class decides your conformity route.
The guide, chapter by chapter
Each chapter links to our in-depth guide on that topic. The links below go straight to the part you need.
01
What the CRA is and who it applies to
Which products count as products with digital elements, how the four product classes split, and when a non-EU manufacturer is in scope.
02
CRA timeline and penalties
The five dates between December 2024 and December 2027, what applies today, and the fine band attached to each kind of breach.
03
Essential requirements and security by design
The Annex I requirements in plain terms: secure default configuration, a reduced attack surface, and security updates for the whole support period.
04
SBOMs and technical documentation
What the technical file must hold, what the SBOM has to cover, and how to keep both matched to the build that actually shipped.
05
Conformity assessment
Which route your product class allows, when a notified body gets involved, and what has to be in place before the CE mark goes on.
06
Vulnerability handling and reporting
Article 14 reporting through ENISA's platform, a coordinated disclosure policy, and triage that separates reachable vulnerabilities from the rest.
07
Support periods and lifecycle obligations
How to set a support period you can defend, which security updates you owe during it, and what happens at end of life.
08
CRA readiness
A gap assessment you can run against your own products, the mistakes that stall programs, and where to start before December 2027.
09
The CRA and other regulations
Where the CRA overlaps with RED Article 3.3, NIS2 and the harmonised standards still being written, and which evidence you can reuse across them.
Five terms the CRA uses in a specific way
- Manufacturer
- Whoever develops or has a product developed and markets it under their own name or trademark. Carries most of the obligations.
- Importer
- An EU-based party placing a non-EU manufacturer's product on the EU market. Must check the manufacturer met its obligations.
- Notified body
- An independent assessment body designated by a Member State to run third-party conformity assessments.
- Actively exploited vulnerability
- A vulnerability with reliable evidence that someone has exploited it in a system without the owner's permission. Triggers Article 14 reporting.
- Single Reporting Platform
- ENISA's portal for Article 14 notifications. One submission reaches the coordinating CSIRT and ENISA.
CRA questions manufacturers ask first
Could you produce your CRA evidence tomorrow?
A market surveillance authority can ask for the technical file at any point after December 2027, and a reporting clock can start any day now. Your team can build and own that record, or a Finite State practitioner can work inside your program and build it with you.