The Executive Guide to the EU Cyber Resilience Act
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
The CRA regulates the product itself, not how you handle data, and it applies identically across all 27 EU member states with no national variation to track.
Executive summary
Regulation (EU) 2024/2847 — the Cyber Resilience Act — entered into force on 10 December 2024, the EU's first horizontal law imposing mandatory cybersecurity requirements directly on products, not on how organizations handle data. Two dates matter most: vulnerability- and incident-reporting obligations begin 11 September 2026, and the full set of essential cybersecurity requirements — secure by design, SBOM, vulnerability handling, CE marking — applies from 11 December 2027. If your organization manufactures, imports, or distributes a product with digital elements sold into the EU, the CRA is not a future problem. The September 2026 deadline requires a working, exercised 24-hour incident-reporting capability, not a policy document — and that capability is not something any organization builds in the weeks before the deadline. This guide covers who the CRA applies to, what it actually requires, which conformity assessment route a given product falls into, and a realistic path to being ready before enforcement begins.
Key findings
Reporting obligations begin 11 September 2026 — under a year away from most readers' perspective — and require a real, exercised incident-response capability, not a policy document.
The CRA's enforcement model is product-safety law (CE marking, market surveillance, tiered fines), not data-protection law — a mature GDPR program does not transfer directly.
A confirmed SBOM, generated automatically as part of the build pipeline, is the single highest-leverage first step across every product tier.
The 24-hour early-warning deadline for actively exploited vulnerabilities is the most operationally demanding requirement in the regulation.
Classification (default / important / critical) determines everything downstream — which conformity assessment route applies, how much third-party involvement is required, and how much lead time the program needs before December 2027.
Manufacturer, importer, and distributor carry legally distinct obligations, and a distributor that white-labels or modifies a product can be reclassified as the manufacturer — inheriting the full obligation set.
Non-compliance is a market-access problem before it is a fine: a product without a valid CE mark under the CRA cannot legally be sold in the EU at all.
Very High
12–24 months
Organization-wide
Written for CISOs, Compliance Directors, Product Security leaders, and Executive Management at any organization that manufactures, imports, or distributes hardware or software into the EU market.
Third-party conformity assessment (tier-dependent)
Market access gate
September 18, 2026
v4
47 min
What the CRA Is, and Why It's Different
Most EU digital regulation to date has governed how you handle data (GDPR) or how large platforms behave (DSA/DMA). The Cyber Resilience Act governs the product itself: its security properties at the point of sale, and for its entire declared support period afterward.[1]
It borrows its enforcement structure — CE marking, market surveillance authorities, tiered fines — from EU product-safety law, the same regulatory family as machinery or toy safety, not from data-protection law. That is a deliberate signal: the EU is treating exploitable software the way it treats a faulty physical product.
It is also a Regulation, not a Directive — the distinction is more than a technicality. NIS2, the EU's other major recent cybersecurity law, is a Directive: each member state transposes it into its own national law, and implementation details vary by country.[16] The CRA is directly applicable, word for word, in all 27 member states the moment it takes effect, with no national transposition step and no member-state-by-member-state variation to track. A compliance program built for one EU country's CRA obligations is, by construction, the program for all of them.
The CRA and NIS2 are frequently confused because they arrived close together and both use the word "cybersecurity" in their title, but they regulate different things: NIS2 governs how certain organizations — critical-infrastructure operators, medium and large entities in named sectors — run their own security programs. The CRA governs what a product must be, structurally, before it can be sold. An organization can be in scope for both, neither, or just one; being NIS2-compliant does not satisfy a single CRA obligation, and vice versa.
Continue with the complete Executive Guide
15 more sections, written out in full — not previews
10 more diagrams and illustrations
11 comparison tables and reference matrices
Executive Checklist, Implementation Roadmap & Audit Worksheet
The complete, board-ready PDF
Who It Applies To — The Scope Test
If a product your organization sells into the EU has any connection to a network or device, assume the CRA applies until you've confirmed otherwise.
Business Impact
Non-compliance is first a market-access problem and only second a fine — a product without a valid CE mark cannot legally be sold in the EU at all.
Product Classification, Worked Through
A product's classification — Default, Important, or Critical — determines its entire compliance path, cost, and timeline, so get it right at the component level.
Conformity Assessment Routes — Which One Applies, and the Trade-offs
Self-assessment is faster and cheaper, but third-party assessment is the only route for Critical products and most Important Class II products — the choice isn't always yours to make.
Security by Design and by Default
Most "secure by design" gaps found in practice aren't exotic — they're a default admin password, a disabled update mechanism, or logging that's off by default.
SBOM Requirements, Explained
A build-pipeline-generated SBOM is the single fastest, cheapest compliance step available, and the first artifact a regulator will ask to see.
Vulnerability Handling Across the Support Period
Vulnerability handling is five separate, concurrent commitments — not one requirement — and the cheapest of the five to close is a coordinated disclosure policy you can stand up in days.
Implementation Roadmap
A realistic path to December 2027 needs to start now, with an executive owner named in the first 90 days — not in the quarter before the deadline.
The Vulnerability-Reporting Clock
The 24-hour early-warning deadline is the single most operationally demanding requirement in the entire regulation, and it has to be rehearsed before it's needed.
Manufacturer, Importer, and Distributor Responsibilities
Manufacturer, importer, and distributor carry legally distinct obligations — and white-labeling or modifying a product can quietly turn a distributor into a manufacturer.
Framework Mapping
An existing ISO 27001 or NIST CSF program covers real ground here, but SBOM, support-period commitments, and the 24-hour reporting clock have no direct precedent in either framework.
Action Checklists
These three checklists are the fastest way to translate everything above into assigned, trackable work this week.
Common Mistakes
Nearly every CRA compliance failure traces back to one of these seven avoidable mistakes.
Frequently Asked Questions
The questions below are the ones every executive and engineering team asks first — start here if you only have five minutes.
Penalties
Fines are tiered and scale with company size, but they're rarely the first — or most disruptive — enforcement action a regulator takes.
References
Regulation (EU) 2024/2847, Art. 2–3 — Scope and definitions
Regulation (EU) 2024/2847, Annex III — Important products with digital elements
Regulation (EU) 2024/2847, Annex IV — Critical products with digital elements
Regulation (EU) 2024/2847, Annex I, Part I — Security requirements relating to product properties
Regulation (EU) 2024/2847, Annex I, Part II — Vulnerability handling requirements
Regulation (EU) 2024/2847, Art. 14 — Reporting obligations
Regulation (EU) 2024/2847, Art. 16 — Single reporting platform
Regulation (EU) 2024/2847, Art. 10–13 — Manufacturer, importer, distributor obligations
Regulation (EU) 2024/2847, Art. 64 — Penalties
ISO/IEC 27001:2022, Annex A — A.8.8, A.8.25, A.5.23
NIST Cybersecurity Framework 2.0, Govern, Identify, Protect, Detect, Respond, Recover functions
IEC 62443 series — Industrial communication networks security, referenced, not reproduced
Regulation (EU) 2024/2847, Chapter IV and Annex VI — Conformity assessment procedures
Regulation (EU) 2024/2847, Art. 30 — CE marking
Regulation (EU) 2024/2847, Art. 71 — Transitional provisions
Directive (EU) 2022/2555 (NIS2), cited for comparison, not a CRA provision
Explore CRA
Hub overview →
Full application
Dec 11, 2027
Related Executive Guides
A practical checklist for standing up automated Software Bill of Materials generation — the single highest-leverage first step under the CRA, across every product tier.
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.
Related Articles
The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.
Unlike NIS2, DORA needed no national transposition — it became binding across the entire EU financial sector on a single day. Here's what that actually triggers.