Guides › Cyber Resilience Act
Cyber Resilience Act: what manufacturers need to do now.
The Cyber Resilience Act (Regulation (EU) 2024/2847) makes cybersecurity a prerequisite for the CE marking. It applies to almost every product with software, from routers and controllers to desktop applications. The first obligations already apply, and the CRA will apply in full from December 2027.
Who the CRA affects.
The CRA applies to products with digital elements placed on the EU market: hardware and software that can be connected directly or indirectly to a device or network, including the associated remote data processing.
Manufacturers
Anyone who develops a product, or has it developed, and markets it under their own name bears the main obligations: secure development, vulnerability management, documentation and reporting.
Importers and distributors
They may only place products on the market that meet the requirements and must check that the CE marking and documentation are present.
Not covered
Areas with their own rules such as medical devices, motor vehicles and aviation, pure cloud services without an associated product, and non-commercial open-source software.
Whether a product falls under the CRA, and into which category, should be assessed on a case-by-case basis. This guide does not constitute legal advice.
The timeline up to 2027.
The obligations come into force in stages. The reporting obligations already apply today, including for products that are already on the market.
Entry into force
The regulation is in force. The transition periods are running.
Conformity assessment bodies
The rules for conformity assessment bodies apply, so that assessments are possible in good time.
Reporting obligations
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents.
Full application
From 11 December 2027, only products that meet all requirements and bear the CE marking may be placed on the market.
The more critical the product, the stricter the assessment.
| Category | Examples | Conformity assessment |
|---|---|---|
| Default | Most products, such as application software, games, smart speakers | Self-assessment by the manufacturer |
| Important, class I | Password managers, VPNs, routers, operating systems, smart home systems with security functions | Self-assessment only with harmonised standards, otherwise a conformity assessment body |
| Important, class II | Firewalls, intrusion detection systems, hypervisors, tamper-resistant microprocessors | Assessment by a notified body |
| Critical | Hardware devices with security boxes, smart meter gateways, smartcards | European cybersecurity certification where applicable |
What the CRA requires of manufacturers.
The essential requirements are set out in Annex I. They apply throughout the entire life cycle, not just at the point of sale.
Security by design
No known exploitable vulnerabilities at delivery, a secure default configuration, protection of confidentiality and integrity, and the smallest possible attack surface.
Risk assessment
A documented assessment of the product’s cybersecurity risks that is taken into account in development, production and maintenance.
Software bill of materials (SBOM)
A list of the components contained, at least the top-level dependencies, so that vulnerabilities can be attributed quickly.
Vulnerability management
Check for vulnerabilities regularly, fix them without delay, and provide a coordinated vulnerability disclosure policy and a contact address for reports.
Security updates
Free security updates throughout the support period, generally at least five years, distributed securely.
Documentation and CE
Technical documentation, EU declaration of conformity, CE marking and security information for users.
Reporting in three stages.
You report actively exploited vulnerabilities and severe incidents affecting the security of your product via ENISA’s single reporting platform to the competent CSIRT, in Germany the BSI. More on the reporting obligations under NIS2 and GDPR in the reporting obligations guide.
Early warning
That a vulnerability is being actively exploited or a severe incident has occurred, and in which countries the product is offered.
Notification
General information about the product, the nature of the exploitation and the corrective or mitigating measures taken or recommended.
Final report
For vulnerabilities no later than 14 days after a fix has been made available, for severe incidents no later than one month after the notification.
In addition, you must inform the users of your product and, where necessary, tell them about remedial measures. Infringements of the essential requirements can be punished with fines of up to €15 million or 2.5% of worldwide annual turnover.
CRA-ready in 6 steps.
Record your products
Which of your products have digital elements, and which category do they fall into?
Set up the reporting process
Responsibilities, criteria and templates for the 24-hour early warning, because this obligation already applies.
Create an SBOM
Capture components and versions for each product automatically and keep them up to date.
Manage vulnerabilities
Publish a disclosure policy, set up a contact address, track findings and fix them.
Assess risks
Document cybersecurity risks for each product and feed them into development.
Prepare for conformity
Plan technical documentation, the support period and the conformity assessment well before December 2027.
Keep CRA obligations under control with WolfISMS.
The CRA catalogue is included in WolfISMS. You track vulnerabilities in vulnerability management, the reporting assistant in the incident module shows the CRA deadlines and provides pre-filled notification texts, and you assess risks using the same methodology as in the rest of your ISMS.