Does the EU Cyber Resilience Act apply to US companies?
Yes. The EU Cyber Resilience Act applies to every US company that sells hardware or software products with a data connection in the EU. Reporting duties apply from 11 September 2026 and all other duties from 11 December 2027.
Key takeaways
- The Cyber Resilience Act sets obligations by market, so a manufacturer in the United States has the same duties as a manufacturer in the EU for each product it places on the EU market.
- From 11 September 2026, a US manufacturer must report each actively exploited vulnerability and each severe incident in its products through the ENISA Single Reporting Platform, starting with an early warning within 24 hours.
- A US manufacturer with no establishment in the EU reports to the CSIRT of a Member State chosen by a fixed order in Article 14(7), which starts with its authorised representative, then its importer, its distributor and its users.
- An authorised representative in the EU is optional, because Article 18(1) says a manufacturer may appoint one by a written mandate.
- From 11 December 2027, an EU importer must check the conformity assessment, the technical documentation, the CE marking and the EU declaration of conformity before it places a US product on the market.
Who counts as a manufacturer under the CRA?
A manufacturer is a person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its own name or trademark (Article 3, point (13)).
The definition has no location test. A US company that sells routers, industrial controllers, connected consumer devices or installable software in the EU under its own brand is the manufacturer of those products. Article 2(1) covers each product with digital elements whose intended purpose or reasonably foreseeable use includes a data connection to a device or network.
Software supplied only as a web service is generally outside the scope. The CRA scope page sets out where that boundary falls and which sectors have their own rules.
When do the obligations apply to a US manufacturer?
Article 14 reporting applies from 11 September 2026. Every other obligation applies from 11 December 2027 (Article 71(2)). The dates are the same for EU and US manufacturers.
| Date | What applies | Legal basis |
|---|---|---|
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents. It also covers products placed on the EU market before 11 December 2027. | Article 71(2), Article 69(3) |
| 11 December 2027 | All other obligations. These include the Annex I essential requirements, vulnerability handling, the technical documentation, the EU declaration of conformity and the CE marking. | Article 71(2) |
| Before 11 December 2027 | A product placed on the EU market before that date gets the other obligations only after a substantial modification. | Article 69(2) |
How does a US manufacturer report under Article 14?
A US manufacturer submits each report through the ENISA Single Reporting Platform to the CSIRT designated as coordinator in one Member State. ENISA can see each report at the same time (Article 14(7)). The deadlines are the same as for an EU manufacturer.
| Stage | Actively exploited vulnerability, Article 14(2) | Severe incident, Article 14(4) |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Within 24 hours of becoming aware |
| Notification | Within 72 hours of becoming aware | Within 72 hours of becoming aware |
| Final report | No later than 14 days after a corrective or mitigating measure is available | Within one month after the incident notification |
Which CSIRT receives the reports of a manufacturer with no EU establishment?
Article 14(7) sets a fixed order of four Member States. The manufacturer reports to the first one in the order that it can determine from the information it has.
A US company with an establishment in the EU first applies the main establishment rule. The main establishment is in the Member State where the decisions on the cybersecurity of the products are mainly taken. If that Member State cannot be found, it is the Member State of the establishment with the most employees in the EU.
| Order | Member State that receives the reports |
|---|---|
| 1 | Where the authorised representative that acts for the highest number of the manufacturer's products is established |
| 2 | Where the importer that places the highest number of the manufacturer's products on the market is established |
| 3 | Where the distributor that makes the highest number of the manufacturer's products available is established |
| 4 | Where the highest number of users of the manufacturer's products are located |
A manufacturer that reports under step 4 may send its later reports to the same CSIRT that it first reported to.
Does a US manufacturer need an EU authorised representative?
An authorised representative is optional. Article 18(1) says a manufacturer may appoint one by a written mandate.
The mandate must let the representative keep the EU declaration of conformity and the technical documentation available to market surveillance authorities for at least 10 years or for the support period, whichever is longer. The representative also gives documents to an authority on a reasoned request and cooperates with the authorities (Article 18(3)).
The core duties in Article 13(1) to (11), the first subparagraph of Article 13(12) and Article 13(14) stay with the manufacturer and cannot go into the mandate (Article 18(2)). An appointed representative also sets the reporting Member State, because it is step 1 of the order above.
What do EU importers and distributors check before they sell a US product?
An EU importer must make sure of four points before it places a US product on the market (Article 19(2)). An EU distributor must check the CE marking and the documents before it makes the product available (Article 20(2)).
The importer is the company established in the EU that places a product under the name or trademark of a non-EU company on the EU market (Article 3, point (16)). An importer that has reason to believe a product does not conform must hold it back until it conforms (Article 19(3)). A US manufacturer that cannot give its importer these documents cannot get its products to EU buyers through that importer.
| Party | Checks before selling | Legal basis |
|---|---|---|
| Importer | The manufacturer carried out the conformity assessment procedure | Article 19(2)(a) |
| Importer | The manufacturer drew up the technical documentation | Article 19(2)(b) |
| Importer | The product bears the CE marking and comes with the EU declaration of conformity and the Annex II information and instructions to the user | Article 19(2)(c) |
| Importer | The product carries a type, batch or serial number, the manufacturer's contact details and the end date of the support period | Article 19(2)(d), with Article 13(15), (16) and (19) |
| Distributor | The product bears the CE marking, and the manufacturer and the importer met their labelling duties and gave the distributor all necessary documents | Article 20(2) |
What fines can a US manufacturer get?
A breach of the Annex I essential requirements or of Articles 13 and 14 can lead to an administrative fine of up to EUR 15 million or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 64(2)).
Worldwide turnover includes revenue earned in the United States. The market surveillance authorities of the Member States impose the fines.
How does CVD Portal help a US manufacturer?
CVD Portal keeps every CRA obligation for each product in one place, from the classification to the EU declaration of conformity and Article 14 reporting.
- Settings finds the reporting Member State from the authorised representative, importer, distributor or user location that you record.
- The platform prepares each Article 14 stage with its deadline. An authorised person at your company submits each stage on the ENISA Single Reporting Platform.
- Each product has one record for its classification, Annex I evidence, technical documentation and EU declaration of conformity, which are the documents an EU importer asks for.
- A free vulnerability disclosure portal on your own subdomain receives researcher reports.
Frequently asked questions
Does the CRA apply to software sold by a US company?
Yes, when the software is a product with digital elements made available on the EU market. Installable software and firmware are in scope. Software supplied only as a web service is generally outside the scope, unless it is remote data processing for a product that is in scope.
Does the CRA apply to products that a US company already sells in the EU?
Article 14 reporting applies to those products from 11 September 2026 (Article 69(3)). The other obligations apply to a product placed on the EU market before 11 December 2027 only if it gets a substantial modification from that date (Article 69(2)).
Is an authorised representative the same as an importer?
An authorised representative is a person established in the EU that acts for the manufacturer under a written mandate (Article 3, point (15)). An importer is a person established in the EU that places on the market a product bearing the name or trademark of a person established outside the EU (Article 3, point (16)). One company can hold both roles.
Do the CRA fines count US revenue?
Yes. Article 64(2) sets the fine cap as a share of total worldwide annual turnover for the preceding financial year, so revenue earned in the United States counts toward the cap.
Sources
- Regulation (EU) 2024/2847, the Cyber Resilience Act, EUR-Lex CELEX:32024R2847. Articles 2, 3, 13, 14, 18, 19, 20, 64, 69 and 71.
This page summarises the text of Regulation (EU) 2024/2847. It is not legal advice.
Published by Porta Regulus B.V., KvK 42062307. Read the editorial policy.
Last updated on 2026-10-28.
Prepare your Article 14 reports and EU documents
Start a trial to set your reporting Member State and build the documents an EU importer asks for. The free classifier tells you first whether the CRA applies to your product.