CRA (Cyber Resilience Act): obligations and how to prepare
CRA obligations apply to anyone who manufactures, imports or distributes products with digital elements in the EU. In addition, since 11 September 2026 you must already report exploited vulnerabilities and severe incidents. Here you will find the timeline, the Annex I requirements and how to prepare before December 2027.
In 30 seconds: Regulation (EU) 2024/2847 entered into force on 10 December 2024. The rules on notified bodies have applied since 11 June 2026. Then, on 11 September, reporting to ENISA began. Everything else, including CE marking, applies from 11 December 2027. So set your support period now, prepare your SBOM and check whether your product is important or critical.
What the CRA is and who its obligations apply to
The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847. It sets cybersecurity requirements for hardware and software that connect to a device or a network. As a regulation, it applies directly, with no national transposition.
CRA obligations fall mainly on the manufacturer, but they also reach importers and distributors. There is also a light-touch regime for open-source software stewards. By contrast, free and open-source software not supplied in a commercial activity is out of scope. The CRA also leaves out products with their own sectoral rules, such as medical devices, vehicles and aviation.
If you make connected devices, you will find more context on our page for connected product manufacturers.
CRA timeline: key dates from 2024 to 2027
These dates match those published by the European Commission on its CRA page:
| Date | What happens |
|---|---|
| 10/12/2024 | Entry into force of Regulation (EU) 2024/2847 |
| 01/12/2025 | Publication of Implementing Regulation (EU) 2025/2392 on important and critical products |
| 11/06/2026 | Chapter IV applies: notifying authorities and notified bodies |
| 27/07/2026 | Commission practical guidance on applying the CRA |
| 11/09/2026 | Mandatory reporting of exploited vulnerabilities and severe incidents |
| 11/12/2027 | Full application: essential requirements, conformity assessment and CE marking |
Note: the CRA only covers a product placed on the market before 11/12/2027 if it undergoes a substantial modification afterwards. However, the CRA obligations on reporting reach every product available in the EU, including older ones.
Manufacturer CRA obligations: Annex I
Annex I sets out the essential cybersecurity requirements in two parts. First, the manufacturer must assess cybersecurity risks and take them into account throughout the lifecycle. It must also make sure third-party components do not compromise the product’s security.
Product requirements (Part I)
- No known exploitable vulnerabilities when placed on the market.
- Secure-by-default configuration, with the option to reset to the original state.
- Security updates, automatic by default with an opt-out.
- Access control, encryption and protection of data integrity.
- Data minimisation and a reduced attack surface.
- Logging of relevant activity and secure deletion of data.
Vulnerabilities, SBOM and support period (Part II)
Part II requires you to handle vulnerabilities throughout the support period. To do so, you must draw up a software bill of materials (SBOM) in a machine-readable format. At a minimum, it covers top-level dependencies, and the authority can ask you for it. You also need a coordinated vulnerability disclosure policy and a contact point for reports.
For its part, the support period lasts at least five years, unless the expected use is shorter. You must state its end date, with month and year, at the time of purchase. In addition, each security update must remain available for ten years or, if longer, until support ends.
In practice, CRA obligations turn security into a continuous process rather than a launch formality.
Important and critical products: Annexes III and IV
Most products can use self-assessment (module A) before affixing the CE marking. By contrast, products in Annexes III and IV follow stricter procedures. Implementing Regulation (EU) 2025/2392 describes each category, and what counts is the product’s core functionality.
| Category | Examples | Assessment |
|---|---|---|
| Important, class I (Annex III) | Browsers, password managers, VPNs, operating systems, routers, smart cameras and door locks | Self-assessment only with harmonised standards or certification; otherwise, a notified body |
| Important, class II (Annex III) | Hypervisors, firewalls, intrusion detection and prevention systems | Notified body or European certification |
| Critical (Annex IV) | Smart meter gateways, smartcards and secure elements | European certification where required; otherwise, as for class II |
That said, a product does not fall into these categories just because it integrates one of their components. For example, a news app with a built-in browser does not become a browser. This classification does not change the manufacturer’s CRA obligations, only the procedure for proving compliance. Therefore, for class I, keep an eye on harmonised standards: without them, you will need a notified body.
Reporting to ENISA: CRA obligations since September 2026
Since 11 September 2026, the CRA reporting obligations have applied to every manufacturer. They cover actively exploited vulnerabilities and severe incidents that compromise a product’s security. Reports go through ENISA’s Single Reporting Platform, which went live that same day. These are the deadlines:
- 24 hours: early warning from the moment you become aware.
- 72 hours: notification with general information and an initial assessment.
- 14 days after a fix is available: final report on the vulnerability.
- One month after the 72-hour notification: final report on the severe incident.
The report reaches your country’s coordinating CSIRT and ENISA at the same time. In Spain, that CSIRT is INCIBE-CERT, the national cybersecurity institute’s response team. To log in you need an EU Login account with multi-factor authentication, so set it up before your first report. Fines do not apply to micro and small enterprises that miss the 24-hour deadline, although they must still report.
The process resembles the one we explain for reporting a data breach within 72 hours.
How the CRA relates to NIS2 and the Data Act
The CRA governs product security, whereas NIS2 governs organisations that provide essential or important services. Therefore, a manufacturer can be subject to both, and one incident can trigger two reports. If in doubt, start by checking whether NIS2 applies to you. In addition, buying compliant products helps NIS2 entities secure their supply chain.
The EU Data Act, on the other hand, governs access to the data that connected products generate. Since 12 September 2026, manufacturers must design new products to make that access easier. As a result, the same device must meet CRA obligations on security and Data Act duties on data. We explain this in what the EU Data Act means for your company.
Finally, in November 2025 the Commission proposed the Digital Omnibus. Among other things, it proposes a single entry point for reporting incidents under NIS2, the GDPR, DORA and other laws. It is still under negotiation, so no CRA deadline changes today.
Frequently asked questions
Do CRA obligations apply to software as a service (SaaS)?
Generally not: pure SaaS is out of scope and usually falls under NIS2. However, the CRA does cover remote data processing without which a product cannot work.
What penalties apply for breaching CRA obligations?
Breaching the essential requirements or Articles 13 and 14 can cost up to EUR 15 million. The cap rises to 2.5% of worldwide annual turnover if that figure is higher. Other infringements carry caps of EUR 10 million or 2%. For incorrect information, the caps are EUR 5 million or 1%. Each Member State then sets out its own penalty regime.
Do CRA obligations apply to importers and distributors?
Yes, although they are lighter than the manufacturer’s. The importer checks the conformity assessment, the technical documentation and the CE marking. For its part, the distributor verifies the CE marking and the user information. Moreover, if either sells the product under its own brand or substantially modifies it, it takes on the manufacturer’s role.
How long must the support period be?
At least five years, unless the product’s expected use is shorter. In addition, buyers must know when support ends before they pay.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC helps you meet CRA obligations product by product: one control, many regulations. You inventory products and components, and you store the SBOM and technical documentation as evidence. In addition, you reuse that evidence for NIS2, ISO 27001 and the Data Act. The regulatory clock also alerts you to support end dates and the 2027 deadlines. When attackers exploit a vulnerability, incident management guides you through the 24 and 72-hour deadlines. See the CRA guide or request a demo.
