What the CRA requires of connected products, the timeline up to 2027 and what your development team should do now.
In short
The Cyber Resilience Act is an EU regulation that makes manufacturers responsible for the cybersecurity of hardware and software products with digital elements for their whole lifecycle. Reporting of actively exploited vulnerabilities has applied since 11 September 2026, and the main requirements apply from 11 December 2027. Start with scope, an SBOM and a vulnerability process.
For product companies, the CRA is less a legal project than an engineering one. It asks how your product is designed, what it contains, how you find and fix vulnerabilities, and how long you support it. This guide is written by Devies, a Gothenburg-based product and engineering consultancy, for product owners, technical leads and CTOs at companies that build connected devices or software sold in the EU.
What does the Cyber Resilience Act cover?
The Cyber Resilience Act covers almost every hardware or software product with digital elements that can connect, directly or indirectly, to a device or a network and is placed on the EU market.
Regulation (EU) 2024/2847 is the full name. A product with digital elements is a software or hardware product, plus its remote data processing solutions, including components placed on the market separately. That means firmware in an industrial sensor, a mobile app, a desktop program, a smart home device and a software library sold as a product can all be in scope.
Some products are excluded because sector rules already cover them, such as medical devices, motor vehicles and civil aviation equipment. Pure software as a service is generally outside the CRA, unless it is a remote data processing solution that the product needs to perform one of its functions. Free and open-source software developed outside a commercial activity is also outside scope.
The CRA also sorts products into risk levels, and the level decides how conformity is shown:
Category
Examples from the regulation
How conformity is shown
Default
Examples from the regulation
Most products with digital elements
How conformity is shown
Self-assessment by the manufacturer
Important, class I
Examples from the regulation
Password managers, VPNs, routers, smart home assistants
How conformity is shown
Harmonised standard, or third-party assessment
Important, class II
Examples from the regulation
Firewalls, intrusion detection, tamper-resistant microprocessors
How conformity is shown
Third-party assessment by a notified body
Critical
Examples from the regulation
Smart meter gateways, smartcards, hardware security boxes
How conformity is shown
Possibly European cybersecurity certification
Your role matters too. The manufacturer carries most obligations, but importers and distributors have their own duties. If you put your brand on a product someone else built, you are treated as the manufacturer.
What is the CRA timeline from 2024 to 2027?
The CRA applies in three steps: it entered into force in December 2024, reporting started in September 2026, and the full requirements apply in December 2027.
As of October 2026, these are the dates confirmed by the European Commission and the regulation itself:
Date
What applies
10 December 2024
What applies
The regulation entered into force
11 June 2026
What applies
Rules on conformity assessment bodies (notified bodies) apply
11 September 2026
What applies
Manufacturers must report actively exploited vulnerabilities and severe incidents
11 December 2027
What applies
All main obligations apply, including essential requirements and CE marking
The middle date is the one teams tend to miss. Since 11 September 2026, reporting duties apply to products already on the market, not only new ones. Products placed on the market before 11 December 2027 are generally only covered by the full requirements if they undergo a substantial modification after that date, but the reporting duty already applies to them.
Fourteen months sounds like plenty, but a product released in late 2027 is being designed now. If its architecture, update mechanism and supplier components are not ready, retrofitting them is expensive.
What are the essential requirements?
The essential requirements, in Annex I of the regulation, demand that products are designed securely and that manufacturers handle vulnerabilities throughout the support period.
Secure by design is the principle that security is built into a product from the first architecture decision rather than added after release. The CRA turns that principle into concrete obligations. Products must, among other things:
- be delivered without known exploitable vulnerabilities
- ship with a secure default configuration, with the option to reset to the original state
- receive security updates, automatically by default where suitable, with an opt-out
- protect against unauthorised access with appropriate authentication and access control
- protect the confidentiality and integrity of stored and transmitted data
- collect and process only the data needed for the product's intended purpose
- limit attack surfaces, including external interfaces
- record and monitor relevant internal activity, such as access to data and services
- let users remove all data and settings securely
Manufacturers must also run a cybersecurity risk assessment, document it in the technical documentation and keep it up to date. The support period, during which vulnerabilities must be handled, must reflect how long the product is expected to be used and is generally at least five years.
Non-compliance with the essential requirements can lead to fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher. The bigger commercial risk is simpler: products without CE marking under the CRA cannot be sold in the EU after December 2027.
Product security is now a product property you document, not a promise in a sales deck.
How should you handle SBOM and vulnerabilities?
You need a software bill of materials for every release and a working vulnerability process that can meet a 24-hour reporting deadline.
An SBOM (software bill of materials) is a machine-readable list of the components and dependencies inside a software release. The CRA requires manufacturers to draw one up in a commonly used, machine-readable format covering at least the top-level dependencies. Formats such as CycloneDX and SPDX are widely used for this. The SBOM must match what customers actually receive, not what a developer has installed locally.
The vulnerability handling requirements in Annex I, Part II, go further than an SBOM. You must:
- identify and document the components in each product
- fix vulnerabilities without delay, including by providing security updates
- test and review the product's security regularly
- publish information about fixed vulnerabilities once an update is available
- have a coordinated vulnerability disclosure policy and a contact address for reports
- distribute updates securely and, where possible, free of charge with advisory messages
Reporting is the time-critical part. According to the Commission's CRA reporting guidance, manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident, a full notification within 72 hours, and a final report later. Reports go through the Single Reporting Platform run by ENISA to the national CSIRT where you have your main establishment.
A practical check for your team: pick one third-party library in your latest release. Can you tell, within an hour, which shipped versions contain it, which customers run them and who can approve an emergency update? If not, start there.
If your company is also an essential or important entity, the Swedish Cybersecurity Act adds organisation-level duties; see our upcoming guide to NIS2 and the Swedish Cybersecurity Act.
Keep reading
From our work
Consilium and Devies Cybersecurity+Consilium Safety Group and Devies Cybersecurity+: a partnership for future-proof cybersecurity in fire, flame and gas safety systems.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
When does the Cyber Resilience Act apply?
The Cyber Resilience Act entered into force on 10 December 2024. Rules on notified bodies apply from 11 June 2026, and manufacturers' duty to report actively exploited vulnerabilities and severe incidents has applied since 11 September 2026. The main obligations, including the essential requirements and CE marking, apply from 11 December 2027. Reporting already covers products on the market today, so it cannot wait until 2027.
Does the CRA require an SBOM?
Yes. The CRA requires manufacturers to identify and document the components in their products, including by drawing up a software bill of materials in a commonly used, machine-readable format. At a minimum it must cover the product's top-level dependencies. CycloneDX and SPDX are common formats. The SBOM is part of your technical documentation, and it should match the release customers actually receive rather than a developer's local build.
Does the Cyber Resilience Act apply to SaaS?
Generally not on its own. Software provided purely as a service is mainly covered by NIS2 rather than the CRA. However, if a cloud service is a remote data processing solution that a product needs to perform one of its functions, such as the backend of a connected device or app, it falls under the CRA as part of that product. Assess each product and its services together.
What happens if a product does not comply with the CRA?
From 11 December 2027, products without CE marking under the CRA cannot be placed on the EU market, and market surveillance authorities can require corrections, withdrawal or recall. Breaching the essential requirements can lead to fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher. Lower fine ceilings apply to other breaches of the regulation.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
- Cyber Resilience Act, European Commission
- CRA reporting obligations, European Commission
- Devies CRA Alignment Workshop
- Devies cybersecurity services
