All regulations / EU Cybersecurity
Cyber Resilience Act
Know the rule before it knows you.
Security-by-design and vulnerability handling for every product with digital elements, including software.
What it is
The CRA sets cybersecurity requirements for hardware and software products placed on the EU market: secure development, no known exploitable vulnerabilities at release, security updates for the support period, vulnerability handling and reporting of actively exploited vulnerabilities. It works like CE-marking for cybersecurity.
This applies to you if
- You place software, firmware, connected devices or components on the EU market, including through app stores
- You import or distribute such products in the EU
- You provide open-source software commercially
What it asks of you
- Risk assessment and security-by-design throughout the lifecycle
- Vulnerability handling process, coordinated disclosure, SBOM
- Reporting of actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT
- Conformity assessment, technical documentation, CE marking and user information
- Security updates for at least five years or the expected product lifetime
What it costs to ignore
Up to EUR 15 million or 2.5% of worldwide turnover for essential requirements; lower tiers for other breaches.
Key dates
In force 10 December 2024; reporting obligations from 11 September 2026; full application from 11 December 2027.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.