CRA-Compliance-Ressourcen-Hub
The EU Cyber Resilience Act affects every product with digital elements sold in the EU — from consumer IoT devices to industrial software. This hub organises our guides by compliance domain to help you navigate the regulation systematically.
Understanding the CRA
The CRA (Regulation 2024/2847) introduces mandatory cybersecurity requirements for all products with digital elements. It defines product categories, compliance timelines, and the costs involved. Start here to understand what applies to you.
Technical Compliance Requirements
The CRA mandates specific technical documentation for every product. At the core are Software Bills of Materials (SBOMs) and the Annex VII Technical File — machine-readable inventories of every component in your product, paired with vulnerability tracking.
Conformity Assessment & Declaration
Wie Sie die Konformität nachweisen, hängt von Ihrer Produktkategorie ab. Standardprodukte können die Selbstbewertung durchführen (Modul A), während wichtige Produkte und kritische Produkte eine Bewertung durch Dritte benötigen. Beide Wege enden mit einer EU-Konformitätserklärung und CE-Kennzeichnung.
Schwachstellenmanagement
Active vulnerability handling is a CRA first — manufacturers must implement coordinated vulnerability disclosure, report to ENISA within 24 hours, and maintain security updates for the entire support period.
Role-Specific Obligations
Your CRA obligations depend on your role in the supply chain. Manufacturers bear the heaviest burden, but importers and distributors have their own verification and due diligence requirements — and roles can escalate.
Standards & Regulatory Alignment
The CRA doesn't exist in isolation — it interacts with existing standards (ISO 27001, IEC 62443, EN 303 645) and other EU regulations (NIS2, MDR). Understanding these overlaps helps you leverage existing compliance work.
Country-Specific Guides
Each EU member state has its own CSIRT and national coordination body. These guides cover country-specific CRA implementation, local reporting channels, and national cybersecurity agencies.
Industry-Specific Guidance
Some sectors have unique CRA considerations — from automotive supply chains to startup resource constraints. These guides address industry-specific challenges and enforcement risks.
Does the CRA apply to your product?
Beantworte 6 einfache Fragen, um herauszufinden, ob dein Produkt unter den Geltungsbereich des EU Cyber Resilience Act fällt. Erhalte dein Ergebnis in weniger als 2 Minuten.
Bereit für CRA-Konformität?
Beginnen Sie mit der Verwaltung Ihrer SBOMs und Konformitätsdokumentation mit CRA Evidence.