EU Cyber Resilience Act
The first EU law imposing mandatory cybersecurity requirements on hardware and software before it can be sold in the European market. Reporting obligations begin September 2026; full application December 2027.
Regulation (EU) 2024/2847 governs the security of "products with digital elements" — hardware and software with a direct or indirect connection to a device or network — placed on the EU market. It borrows its enforcement model from EU product-safety law (CE marking, market surveillance authorities, tiered fines), not from data-protection law, and applies to most commercial software and connected hardware sold into the EU.
Key deadlines
Entered into force
Reporting obligations begin
Full application
Executive guides & research
The Executive Guide to the EU Cyber Resilience Act
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
Templates & checklists
Glossary
CE Marking
The conformity marking required before a product with digital elements can be placed on the EU market under the CRA, mirroring the mark's use across EU product-safety law.
Conformity Assessment
The process (self-assessment or third-party, depending on product tier) by which a manufacturer demonstrates a product with digital elements meets the CRA's essential requirements before CE marking.
Critical Product (CRA)
The CRA's highest-scrutiny product category, requiring third-party conformity assessment before market placement.
ENISA
The European Union Agency for Cybersecurity — one of the receiving bodies for CRA Article 14's mandatory vulnerability and incident reporting, alongside national CSIRTs.
Important Product (CRA)
A CRA product category (Class I and Class II) — including password managers, VPNs, firewalls, and industrial IoT components — subject to stricter conformity assessment than the default category.
Market Surveillance Authority
The national body responsible for checking CRA compliance and enforcing penalties in each EU member state.
Notified Body
An independent organization designated by an EU member state to carry out third-party conformity assessment for Important Class II and Critical products under the CRA.
Product with Digital Elements
Hardware or software whose intended or reasonably foreseeable use includes a direct or indirect logical or data connection to a device or network — the CRA's core scope trigger (Art. 3).
Software Bill of Materials (SBOM)
A machine-readable inventory of the components in a software product, required under the CRA's Annex I technical documentation obligations.
Support Period
The length of time a manufacturer commits to providing security updates for a product, which must be stated and justified in the product's technical documentation under the CRA.
Related
Stay ahead of CRA changes
Get Regulatory Alerts the moment something about EU Cyber Resilience Act changes — new deadlines, guidance updates, enforcement actions.