EU CRA Overview: The Cyber Resilience Act

A plain-language guide to what the CRA covers, the key compliance dates, enforcement risk, and how it differs from GDPR, NIS2, and the Machinery Regulation.

Scope of the CRA in plain English. The Article 3(1) definition, the forms of a product with digital elements, and the data-connection test that decides whether your product is regulated.

Does your app's API, SaaS or database count as remote data processing under the CRA? The three-question test, and how to sort each backend into a remote data processing solution, a component, or out of scope.

A practical scope and role check for manufacturers, importers, distributors, own-brand products, and re-branders placing digital products on the EU market.

Fine tiers, market surveillance powers, corrective action, withdrawal, recall, and the evidence authorities can request during enforcement.

The manufacturer checklist: secure-by-design requirements, technical documentation, EU Declaration of Conformity, support period, and vulnerability reporting deadlines. Legal basis: CRA Articles 13 and 14 plus Annex I.

The importer checklist: pre-market checks, refusal triggers, supplier verification, and the ten-year retention floor. Legal basis: CRA Article 19.

The distributor checklist: pre-market checks, refusal triggers, and upstream notification when a vulnerability comes to your attention. Legal basis: CRA Article 20.

How any manufacturer may appoint an EU-established representative, what the mandate can cover, and which manufacturer duties cannot be delegated. Legal basis: CRA Article 18.