EU Cyber Resilience Act (CRA)

The EU Cyber Resilience Act (Regulation (EU) 2024/2847, commonly abbreviated 'CRA') is an EU regulation that for the first time establishes mandatory cybersecurity requirements for products with digital elements (PDE) — any hardware or software product that connects to a network or another device. The CRA was published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024. It applies to manufacturers, importers, and distributors who place products on the EU market. The regulation's essential requirements are set out in Annex I; product classification (Default, Important Class I, Important Class II) is set out in Annex III.

The CRA's core obligations for manufacturers include:

• Annex I Part I — secure-by-design requirements: no known exploitable vulnerabilities at launch, secure default configuration, minimal attack surface, protection of confidentiality and integrity.
• Annex I Part II — vulnerability handling: maintain a CVD policy, monitor for vulnerabilities, provide free security patches without undue delay, publish security advisories.
• Article 14 — notify ENISA and national CSIRTs within 24 hours of discovering an actively exploited vulnerability; submit an early warning within 72 hours and a final report within 14 days.
• Article 13(3) — maintain technical documentation including an SBOM.
• Article 28 — register products in the EU database prior to market placement (for Important and Critical products).

The CRA's obligations phase in over the period 2024–2027:

• 10 December 2024 — Regulation enters into force.
• 11 June 2026 — Article 14 vulnerability notification obligations apply; manufacturers must notify ENISA of actively exploited vulnerabilities.
• 11 September 2026 — Market surveillance authority designation and ENISA vulnerability registry obligations apply.
• 11 December 2027 — All remaining obligations apply, including essential requirements (Annex I), conformity assessment, CE marking, and technical documentation requirements.

Manufacturers are advised to begin compliance programmes immediately: supply chain remediation, SBOM implementation, and CVD programme setup each require 12–24 months of lead time.

The CRA establishes significant penalties for non-compliance:

• Failure to meet essential requirements — fines up to €15 million or 2.5% of global annual turnover, whichever is higher.
• Failure to fulfil other obligations (e.g. documentation, notification) — fines up to €10 million or 2% of global annual turnover.
• Providing incorrect or incomplete information — fines up to €5 million or 1% of global annual turnover.

Enforcement is carried out by national market surveillance authorities (MSAs) in each EU member state, coordinated at EU level through ADCO (Administrative Cooperation Working Group on Cyber Resilience). Products found non-compliant can be recalled, restricted, or banned from the EU market.