Cyber Resilience Act (CRA): guide for manufacturers

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) makes cybersecurity a condition for selling connected products in the European Union. Anyone who makes, imports or distributes connected electronics will have to show that their products are secure, and carry the CE marking that proves it.

This is not a distant rule: since 11 September 2026 manufacturers already have to report actively exploited vulnerabilities and severe incidents, and everything else starts to apply on 11 December 2027. This guide summarises the essentials from the point of view of product engineering.

Which products are affected

The CRA applies to products with digital elements: hardware and software whose intended, or reasonably foreseeable, use includes a direct or indirect data connection to a device or a network. In electronics, that covers:

• IoT devices, wearables and connected consumer electronics.
• Industrial controllers, sensors, gateways and network equipment.
• Firmware, operating systems and associated applications, including remote data processing that is part of the product.

Products covered by other specific EU rules, such as medical devices, motor vehicles, civil aviation and marine equipment, are left out, as is non-commercial open-source software. Note that being subject to other legislation does not always mean a product falls outside the CRA, so it is worth checking case by case.

Application timeline

The date most people worry about is 11 December 2027, but another one has already passed: since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products to the authorities. This obligation also covers products that were already on the market before full application.

Products already on the market?Design review and rescue

Not every product has the same obligations

The CRA distinguishes four levels according to risk. Most products fall in the default category and the manufacturer can assess them itself. Important products (classes I and II) and critical products are listed in Annexes III and IV of the Regulation and require more: harmonised standards, a notified body or, in future, a European certification scheme.

Two points that matter in practice:

• The category depends on the product's core functionality, and Implementing Regulation (EU) 2025/2392 specifies which products fall into each one.
• The harmonised standards that will allow self-assessment for class I are still being drafted. Until they are published in the Official Journal of the EU, a class I product may need third-party assessment.

Arriving prepared for the assessment:Test and validation

What the CRA requires from the product

Annex I of the Regulation groups the essential requirements in two blocks. The first concerns the product:

• Designed with a level of cybersecurity appropriate to the risks.
• No known exploitable vulnerabilities when placed on the market.
• Secure by default configuration.
• Security updates throughout the life of the product.
• Protection against unauthorised access, with authentication and access control.
• Protection of the confidentiality and integrity of data, processing only what is necessary.
• A minimised attack surface.

Solved in the design:Hardware designEmbedded firmware

The second block is vulnerability handling throughout the support period:

• A software bill of materials (SBOM) that covers at least the top-level dependencies.
• Regular security tests and reviews.
• A coordinated vulnerability disclosure policy and a contact point to receive reports.
• Fixing vulnerabilities with security updates that are free of charge and distributed without delay.

The support period may not be shorter than five years, unless the product is expected to be used for less time, and the manufacturer must document how it was determined. All of this is reflected in the technical documentation, the EU declaration of conformity and the CE marking.

Update mechanism and SBOM:Embedded firmware

Reporting: what is already mandatory

Since September 2026, manufacturers must report through the ENISA single reporting platform, which passes the information on to the relevant authorities (the CSIRT of the country where the manufacturer is established, and ENISA itself):

• Early warning: within 24 hours of becoming aware.
• Notification: within 72 hours.
• Final report: 14 days after a corrective measure is available, for an actively exploited vulnerability, or within one month of the notification, for a severe incident.

That is why it is worth defining in advance who monitors vulnerabilities, who decides and who reports: 24 hours is very little time to improvise.

No team to watch over it?Vulnerability monitoring

Penalties

Failing to meet the essential requirements can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Other infringements carry up to €10 million or 2%, and giving incorrect information to the authorities up to €5 million or 1%. Authorities can also order a product to be withdrawn from the market.

How we can help

Complying with the CRA is not only a paperwork matter: most requirements are solved in the design of the product, and that is where engineering makes the difference. We work with you from the risk analysis to verification on real hardware, so that your product reaches the conformity assessment, which notified bodies carry out where required, with the technical groundwork done and the documentation ready.

• From risk analysis to architecture: we start from a threat analysis and turn it into hardware and firmware decisions, such as secure boot, signed updates or safe key storage.
• Verification on real hardware, with evidence that goes into the technical file.
• Existing products: we analyse the gaps against Annex I and adapt them without having to redesign everything.

Vulnerability monitoring

The CRA does not end on launch day: throughout the support period, components have to be watched, each vulnerability assessed for its effect on the product and, if it matters, the fix prepared and reported on time. It is continuous work, and not every company has a team dedicated to it.

That is why we also offer a vulnerability monitoring service: we watch the dependencies in your SBOM, assess the impact on your product and prepare the firmware update when it is needed. It is provided as a continuing service, under a periodic licence, so that your team can stay focused on the product.

Where to start

1. Take inventory of your products and define your role for each: manufacturer, importer or distributor.
2. Classify each product: default, important or critical.
3. Set up the reporting process, which is already required.
4. Run a gap analysis against Annex I.
5. Define the support period and how you will distribute updates.
6. Prepare the SBOM and the technical documentation.
7. Plan the conformity assessment route and the schedule up to December 2027.

If you would like to see how this applies to a specific product, tell us about your project and we will go through it with you.

Sources

• European Commission: Cyber Resilience Act.
• European Commission: reporting obligations.
• European Commission: conformity assessment.
• ENISA: CRA single reporting platform.
• Regulation (EU) 2024/2847 on EUR-Lex.