Cyber Resilience Act (CRA): requirements and deadlines

Who the Cyber Resilience Act applies to

The CRA covers products with digital elements made available on the EU market, including the remote data processing a product needs to perform its functions. Manufacturers carry most of the duties. Importers and distributors must check that products carry the CE marking and the required documentation, and open-source software stewards have a lighter set of obligations.

Products covered by their own sector rules are excluded, such as medical devices, motor vehicles, certified aviation products and marine equipment, as are products developed only for national security or defence. Standalone cloud services fall under NIS2 rather than the CRA, unless they are the remote data processing a product needs to work.

Product categories and conformity assessment

How you show conformity depends on the product category. Commission Implementing Regulation (EU) 2025/2392 gives the technical descriptions of the important and critical categories.

• Default products, which is most of them: the manufacturer can assess conformity itself
• Important products, Class I (Annex III), such as password managers, VPNs, operating systems, routers and smart home security products: self-assessment only if you apply harmonised standards, common specifications or a European cybersecurity certification scheme in full; otherwise a notified body assesses
• Important products, Class II (Annex III), such as firewalls, intrusion detection and prevention systems and hypervisors: assessment by a notified body or certification under a European scheme
• Critical products (Annex IV), such as smartcards and smart meter gateways: a European cybersecurity certificate where the Commission requires one, otherwise the Class II route

What the CRA requires

Annex I sets the essential requirements in two parts: the security of the product itself, and how the manufacturer handles vulnerabilities. In practice that means:

• Shipping without known exploitable vulnerabilities and with a secure default configuration
• Making it possible to fix vulnerabilities through security updates, including automatic updates by default where that is appropriate
• Protecting the confidentiality and integrity of data, limiting attack surfaces and reducing the impact of incidents
• Drawing up a software bill of materials (SBOM) that covers at least the top-level dependencies
• Fixing vulnerabilities without delay, testing regularly, publishing information about fixed vulnerabilities and having a coordinated vulnerability disclosure policy
• Providing security updates for a support period of at least five years, unless the product is expected to be used for less time

Reporting deadlines

Since 11 September 2026, Article 14 requires manufacturers to report actively exploited vulnerabilities and severe incidents affecting the security of their products. Reports go through ENISA's Single Reporting Platform to the CSIRT designated as coordinator:

• An early warning within 24 hours of becoming aware
• A notification within 72 hours of becoming aware
• A final report within 14 days after a fix or mitigation is available for a vulnerability, or within one month of the notification for a severe incident

Fines

Breaches of the essential requirements or of the manufacturer obligations in Articles 13 and 14 can be fined up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. Other breaches can be fined up to €10 million or 2%, and supplying incorrect or misleading information up to €5 million or 1%. Member states set and enforce the penalties.

What good CRA help looks like

Most manufacturers need a product classification, a gap assessment against Annex I, a vulnerability handling process with an SBOM and a 24-hour reporting workflow, security testing of the product, and the technical documentation behind the EU declaration of conformity.

For Class II and critical products a notified body carries out the assessment, so keep the consultant who prepares you separate from the body that assesses you. Ask providers which product categories they have worked on and how they will leave your team able to run vulnerability handling after they leave.

How CISO Talents helps

At launch you can post a vCISO request for CRA readiness, or a penetration test of your web app, API or mobile app, through a guided brief. Verified consultants, testers and firms that list Cyber Resilience Act work see it with the reason it matched, and reply in a common format.