A library interior with bookshelves flanking an arched doorway

EU CRA Overview: The Cyber Resilience Act

Get an overview of the EU Cyber Resilience Act and learn what it requires of every product with digital elements placed on the EU market.

Build your CRA expertise

Dive into the regulation, who it applies to, and the obligations that fall on each role in the supply chain. All in one place.

What is the Cyber Resilience Act?

Regulation 2024/2847 in plain language: subject matter, key dates, Article 64 penalties, and how the CRA differs from GDPR, NIS2, and the Machinery Regulation.

Read guide →
Who must comply with the CRA?

The Article 2 scope test, the manufacturer / importer / distributor role axis, and the Article 3(13) own-brand trigger that turns re-branders into manufacturers.

Read guide →
Manufacturer obligations

Article 13 plus Article 14 plus Annex I duties: risk-based design, the technical file, EU Declaration of Conformity, support period, and Article 14 reporting deadlines.

Read guide →
Importer obligations

Article 19 pre-market checks, the refusal duty, the Article 13(15) to (20) verification list, and the ten-year retention floor.

Read guide →
Distributor obligations

Article 20 presence-based pre-market checks, the refusal trigger, and the upstream-notify duty when a vulnerability comes to your attention.

Read guide →
Authorised Representative (Article 18)

When a non-EU manufacturer may appoint an EU-based representative under Article 18(1), what an AR can do under 18(3), and the duties that cannot be delegated under 18(2).

Read guide →
← Back to CRA compliance hub