The EU Cyber Resilience Act (CRA) requires all products with digital elements sold in the EU to meet cybersecurity requirements by December 2027. Key obligations include: maintaining SBOMs (Software Bills of Materials), reporting exploited vulnerabilities to ENISA within 24 hours (from September 2026), and keeping technical documentation for 10 years. Penalties can reach €15 million or 2.5% of global turnover. CRA Evidence helps manufacturers, importers, and distributors achieve compliance through SBOM management, vulnerability scanning, and technical file generation.
EU Cyber Resilience Act (CRA)
EU Regulation 2024/2847 sets cybersecurity requirements for products with digital elements. Here's what you need to know.
What is the Cyber Resilience Act?
The CRA requires companies to document their software supply chain, monitor vulnerabilities throughout a product's lifecycle, and maintain technical files for 10 years. That's a lot of paperwork.
Published as Regulation (EU) 2024/2847, it covers hardware and software products sold in the EU: IoT devices, industrial control systems, standalone software, and more.
The regulation mandates Software Bills of Materials (SBOMs), vulnerability handling processes, risk assessments, and technical documentation. For hardware products, HBOMs are also required. VEX documents communicate vulnerability status to downstream users.
Key Compliance Deadlines
11 September 2026
Vulnerability Reporting Begins
Manufacturers must report actively exploited vulnerabilities to ENISA and national authorities within 24 hours of becoming aware. Detailed reports due within 72 hours.
11 December 2027
Full CRA Enforcement
All products with digital elements must comply with essential cybersecurity requirements. Non-compliant products cannot be sold in the EU market.
Penalties for Non-Compliance
The CRA introduces significant financial penalties for non-compliance. Market surveillance authorities can also order product recalls and prohibit sales in the EU market.
Product Classification
The CRA categorises products based on their cybersecurity risk level. Higher-risk products face stricter conformity assessment requirements.
| Category | Examples | Conformity Assessment |
|---|---|---|
| Default | Most software applications, IoT devices, consumer electronics | Self-assessment allowed |
| Important Class I | Identity management, browsers, password managers, VPNs, network management | Self-assessment if using harmonised standards; otherwise third-party assessment |
| Important Class II | Hypervisors, container runtimes, firewalls, intrusion detection, secure elements | Third-party conformity assessment required |
| Critical | Hardware security modules, smartcard readers, secure boot systems | Strictest requirements (Annex IV) |
Documentation Requirements (Annex VII)
Manufacturers must compile and maintain technical documentation that demonstrates compliance with essential requirements. This documentation must be retained for at least 10 years after the product is placed on the market.
Risk Assessment
Cybersecurity risk assessment covering potential threats, vulnerabilities, and the measures taken to address them.
EU Declaration of Conformity
A formal declaration that the product meets all applicable CRA requirements, signed by an authorised representative.
User Documentation
Instructions for secure installation, operation, and maintenance. Must include information about the support period and security updates.
Vulnerability Handling Policy
Documented process for identifying, tracking, and remediating vulnerabilities. Must include coordinated disclosure procedures.
Test Reports
Evidence of security testing, including penetration tests, code reviews, and verification of essential requirements.
ENISA Vulnerability Reporting
From September 2026, manufacturers must report actively exploited vulnerabilities to ENISA (European Union Agency for Cybersecurity) and their national CSIRT following strict timelines.
Failure to report within the required timeframes can result in significant penalties and reputational damage.
Within 24 Hours
Early Warning - Initial notification of an actively exploited vulnerability or severe incident. Basic information about the threat.
Within 72 Hours
Detailed Report - Technical details, affected products, severity assessment, and initial remediation steps.
Within 14 Days
Final Report (Vulnerabilities) - Complete analysis, root cause, full remediation, and lessons learned.
Within 1 Month
Final Report (Incidents) - For severe security incidents, a final report is due within one month.
How CRA Evidence Helps
The CRA applies differently depending on your role in the supply chain. CRA Evidence adapts to each.
CRA obligations vary by role in the supply chain
Manufacturers
Article 13 puts the heaviest obligations on you: SBOMs, vulnerability handling, security updates, technical documentation.
- SBOM validation (TR-03183)
- Vulnerability monitoring
- Technical file export
- Declaration of Conformity
Importers
Article 19 makes you responsible for verifying manufacturer compliance before you sell in the EU.
- Verification checklists
- Manufacturer tracking
- Evidence storage
- Audit trail
Distributors
Article 20 obligations are lighter: verify CE marking and handle non-compliant products correctly.
- Due care checklists
- Supplier tracking
- CE verification
- Incident escalation
Start preparing now
December 2027 is closer than it looks. Get your products and documentation ready.