The Cyber Resilience Act, Regulation (EU) 2024/2847, applies in stages. The reporting obligations in Article 14 apply from 11 September 2026, requiring manufacturers to report actively exploited vulnerabilities and severe incidents. The main obligations, including the essential cybersecurity requirements, conformity assessment and CE marking, apply from 11 December 2027. Notified body provisions applied earlier, from 11 June 2026.

From 11 September 2026, a manufacturer that becomes aware of an actively exploited vulnerability in its product must submit an early warning within 24 hours. A fuller notification follows within 72 hours, and a final report within 14 days. Severe incidents affecting the security of the product follow the same 24-hour and 72-hour sequence, with a final report within one month. Reports go through the single reporting platform to the CSIRT designated as coordinator and to ENISA.

Awareness of active exploitation, not a confirmed breach or customer harm. The obligation does not wait for an incident, a compromise, or a report from a customer. If a manufacturer becomes aware that a vulnerability in its product is being exploited, the clock starts — including where that awareness comes from a support ticket, a researcher, or a public disclosure. Because the clock starts on awareness, manufacturers need to be able to evidence when awareness occurred.

The CRA covers products with digital elements, meaning any software or hardware product and its remote data processing solutions that can be connected directly or indirectly to a device or network. This reaches most commercial software, including SaaS delivered with remote data processing, embedded firmware, operating systems, connected consumer devices and industrial equipment. Products already regulated under sector-specific EU cybersecurity law, such as medical devices and motor vehicles, are excluded.

Yes. The Cyber Resilience Act is not an AI regulation, and it applies regardless of whether a product contains AI. A conventional SaaS platform, a mobile app with a backend, or an embedded controller falls within scope on the same terms as an AI product. This is why CRA reaches a much wider population of companies than the EU AI Act does.

Products are divided into default products, important products in Class I and Class II, and critical products. Default products, which are the large majority, are self-assessed. Important products face stricter conformity routes, and Class II generally requires a third-party assessment or application of a harmonised standard. Critical products require European cybersecurity certification. Classification determines the conformity route and therefore the cost, which is why it is the first thing to establish.

Broadly no. Products placed on the EU market before 11 December 2027 are not subject to the main obligations unless they are substantially modified after that date. The reporting obligations from 11 September 2026 attach to products the manufacturer is placing on the market from that point, together with the ongoing support obligations for them. This is a forward-looking regime rather than a sweep of the installed base.

The support period is the time during which a manufacturer must provide security updates, and it should reflect the expected product lifetime, with a minimum of five years unless the product is expected to be in use for less. The support period must be communicated to the buyer before purchase. That disclosure now overlaps with the Empowering Consumers Directive’s pre-contractual information requirements for goods with digital elements, which apply from 27 September 2026.

Yes, in substance. Manufacturers must identify and document the components contained in the product, covering at least the top-level dependencies, in a commonly used machine-readable format. The software bill of materials supports the vulnerability handling obligations, because a manufacturer cannot assess whether an upstream vulnerability affects its product without knowing what the product contains.

Manufacturers must identify and document vulnerabilities and components, remediate vulnerabilities without delay including through security updates, apply regular effectiveness testing, publicly disclose fixed vulnerabilities with information about their impact, put a coordinated vulnerability disclosure policy in place, provide a contact address for reporting, and distribute updates securely and free of charge.

Yes. The CRA applies to products with digital elements made available on the EU market, regardless of where the manufacturer is established. A non-EU manufacturer without an EU establishment must appoint an authorised representative in the Union, and the importer and distributor carry their own verification duties before placing the product on the market.

Non-compliance with the essential cybersecurity requirements or the manufacturer obligations can attract fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Breaches of other obligations carry lower ceilings, and supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities carries its own tier.

They regulate different things. NIS2 imposes cybersecurity risk management and incident reporting duties on essential and important entities as organisations. The CRA imposes security requirements on products placed on the market. A company can be an important entity under NIS2 and a manufacturer under the CRA simultaneously, with two separate reporting obligations running on different clocks to different recipients.

Where a high-risk AI system also falls within the CRA, meeting the CRA’s essential cybersecurity requirements is deemed to satisfy the AI Act’s cybersecurity requirements under Article 15, subject to the conditions in Article 12 of the CRA. This is one assessment serving two regimes, but only for the cybersecurity limb — it does nothing for accuracy, robustness, data governance or documentation.

A scope and classification assessment establishing whether the product is in scope and which category applies; a software bill of materials structure and component inventory; a vulnerability handling procedure; a coordinated vulnerability disclosure policy; a 24-hour and 72-hour reporting standard operating procedure with named decision-makers; ENISA and CSIRT intake preparation; technical documentation structure; support period determination and disclosure; and an EU declaration of conformity template.

Most manufacturers do not. Default products, which are the majority, use internal control and self-assessment. A notified body is required for certain important Class II products where harmonised standards have not been applied in full, and critical products require European cybersecurity certification. Establishing your product category early determines whether you need to budget for third-party assessment at all.