Cyber Resilience Act

What is the Cyber Resilience Act?

The Cyber Resilience Act (CRA) is the EU’s first horizontal product-security law. It makes cybersecurity a condition for placing hardware and software products with digital elements on the EU market, much as product safety already is. Compliant products carry the CE marking.

Who does it apply to?

It applies mainly to manufacturers, including software publishers, but also importers and distributors of products with digital elements: anything with software that can connect, directly or indirectly, to a device or network. Some sectors already regulated by their own rules are excluded, such as medical devices, motor vehicles and certain aviation and marine equipment. Free and open-source software developed outside a commercial activity is generally outside scope, with lighter duties for “open-source software stewards”.

Key duties

• Essential cybersecurity requirements: products must be designed, developed and produced to an appropriate level of security. That includes secure-by-default configuration, protection of data, minimal attack surface and the ability to receive security updates.
• Vulnerability handling: identify and document components, including a software bill of materials; fix vulnerabilities without delay; and provide security updates for a support period that reflects expected use, normally at least five years.
• Reporting: notify actively exploited vulnerabilities and severe incidents through the single reporting platform run by ENISA, starting with an early warning within 24 hours. This applies from 11 September 2026.
• Conformity assessment: most products use self-assessment. “Important” and “critical” product classes need harmonised standards or third-party assessment.

How does it relate to other frameworks?

The CRA complements NIS2: NIS2 governs how organisations manage risk, and the CRA governs the security of the products they buy. Secure development practices such as NIST SSDF and OWASP SAMM help manufacturers prepare.