Subject Matter and Purpose of the Cyber Resilience Act

Article 1 defines the subject matter of the Cyber Resilience Act. The regulation lays down rules concerning the placing on the market, making available on the market, or putting into service of products with digital elements to ensure an adequate level of cybersecurity for those products.

The core objective is to address two distinct problems that the EU legislature identified in the digital product market. First, many products are placed on the market with inadequate security properties, leaving consumers and businesses exposed to preventable vulnerabilities. Second, manufacturers frequently fail to provide security updates throughout the reasonable lifetime of their products, leaving users unable to protect themselves after purchase.

Article 1 frames the CRA as a product regulation — meaning its primary enforcement mechanism is market access. Products that do not meet CRA requirements cannot lawfully bear the CE marking and cannot be placed on the EU market.

Article 1, read together with the regulation's recitals, establishes that CRA obligations fall into two broad categories. The first pillar covers security properties of products at the point of design and manufacture — these are the technical requirements in Annex I Part I, such as secure default configurations, minimal attack surfaces, and data protection by design.

The second pillar covers vulnerability handling obligations that persist after the product is placed on the market. These include the coordinated vulnerability disclosure requirements in Article 13, the 24-hour early warning and 72-hour notification obligations in Article 14, and the requirement to provide free security updates for at least five years (or the expected product lifetime, whichever is shorter).

Together, these two pillars reflect the EU legislature's recognition that cybersecurity is not a one-time activity at product launch but a continuing responsibility throughout the product's supported lifetime.

Although Article 1 does not itself define 'products with digital elements', it is the provision that triggers the definition in Article 3. A product with digital elements is any hardware or software product that features a data connection — direct or indirect — to a device or network. This broad definition intentionally captures a wide range of products: consumer IoT devices, industrial control systems, routers, smartphones, operating systems, and standalone software applications.

The breadth of this definition reflects the EU legislature's concern that the digital supply chain is deeply interconnected and that a vulnerability in any component can cascade across many products and systems. Article 1's purpose statement provides important interpretive guidance when applying the definitions in Article 3 to borderline products.

The CRA fits within the EU's New Legislative Framework (NLF) for product regulation. This means it follows the same general architecture as other CE marking directives and regulations: essential requirements, presumption of conformity through harmonised standards, conformity assessment procedures, and market surveillance by national authorities.

Article 1 positions the CRA explicitly within this framework, which has important practical implications. Compliance evidence gathered for the CRA (technical documentation, declarations of conformity, testing records) follows established NLF conventions. Manufacturers with existing CE marking experience will find many of the procedural requirements familiar, even if the cybersecurity substance is new.

One of the most significant innovations of the CRA, established in principle by Article 1 and operationalised in subsequent provisions, is the requirement for post-market security support. Prior to the CRA, no EU-wide rule required manufacturers to continue providing security updates after initial sale.

Article 1 establishes that the regulation's goals include ensuring products remain secure throughout their lifecycle. This principle translates into concrete obligations: manufacturers must define a support period, communicate it to consumers, and actually deliver security updates during that period. The support period must be at least five years for most products, creating a significant long-term commitment for manufacturers that has not previously existed under EU law.