CRA: what it requires and how to comply
The Cyber Resilience Act (CRA) is the first European regulation requiring cybersecurity from products with digital elements across their entire lifecycle. So if you make hardware or software, it affects you —and there are already dates on the calendar: vulnerability reporting from September 2026 and full compliance with CE marking in December 2027—. Atalaya GRC also helps you reach CRA compliance on time.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- Reg. (EU) 2024/2847
- Applies from
- 11 Sep 2026 · 11 Dec 2027
- Who
- Manufacturers of products with digital elements
- If you don’t comply
- Up to €15M or 2.5% of turnover
What is the CRA and what does CRA compliance mean?
The CRA is Regulation (EU) 2024/2847, in force since 10 December 2024. It sets mandatory cybersecurity requirements for products with digital elements placed on the EU market, from design to withdrawal. Therefore, CRA compliance covers the whole product lifecycle.
Who needs CRA compliance?
CRA compliance falls on manufacturers, importers and distributors of hardware and software products with digital connectivity. For example, it covers everything from IoT devices to applications and industrial systems. In addition, we break down the CRA obligations step by step.
Key CRA compliance dates (staggered timeline)
The CRA arrives in phases, so plan your CRA compliance around these dates:
10 Dec 2024
Firstly, the regulation enters into force.
11 Jun 2026
Then come the obligations regarding conformity assessment bodies (Chapter IV).
11 Sep 2026
In addition, the obligation to report exploited vulnerabilities and serious incidents begins (initial notice within 24h, full report within 72h).
11 Dec 2027
Finally, full application: you cannot place any product on the EU market without meeting the CRA and its CE marking.
What does CRA compliance require?
Security by design, vulnerability management throughout the product’s life, risk-assessment documentation (kept for at least 10 years) and security updates. In addition, CRA compliance requires notification of exploited vulnerabilities and serious incidents within the 24h and 72h deadlines.
December 2027: the date you can’t miss
From 11 December 2027, you cannot place any product with digital elements on the EU market without meeting the CRA and obtaining CE marking. Waiting until the last minute isn’t viable: security by design has to be built in beforehand, not bolted on at the end.
Atalaya GRC
How Atalaya GRC helps with CRA compliance
In short, Atalaya GRC turns CRA compliance into something you control:
- Your CRA obligations centralised and also connected to the rest of your compliance.
- The regulatory clock tracks the staggered dates (June and September 2026, December 2027) so none catch you out.
- Notification management for vulnerabilities, so the 24h/72h deadlines stay under control.
- Audit traceability: you also keep the risk-assessment documentation ready and retained as the CRA requires.
Want to see it with your own products?
Request a demoBy sector: Connected-product manufacturers
FAQ
Frequently asked questions
Who does the CRA apply to?
Manufacturers, importers and distributors of products with digital elements (connected hardware and software).
When does the CRA apply?
In force since December 2024; vulnerability reporting applies from September 2026 and full compliance (CE marking) from December 2027.
What reporting deadlines does it require?
For exploited vulnerabilities and serious incidents: initial notice within 24 hours and a full report within 72 hours.
What if my product isn’t compliant by 2027?
From 11 December 2027 it cannot be placed on the EU market without meeting the CRA and obtaining CE marking.
