The EU Cyber Resilience Act (CRA) sets cybersecurity duties for products with digital elements sold in the EU, from secure design and vulnerability handling to user information and conformity assessment. Its reporting duties have applied since 11 September 2026; most other requirements apply from 11 December 2027. This guide explains the practical steps organizations should take and how the European Commission’s 2026 guidance can help. The public materials available for this article do not establish the secIT digital workshop’s agenda, speakers, or exercises, so no advice below is attributed to that event.
What is the Cyber Resilience Act?
The Cyber Resilience Act is Regulation (EU) 2024/2847, an EU product-security law for hardware and software products with digital elements made available on the EU market. It requires cybersecurity to be addressed across a product’s lifecycle—not just tested before release—including planning, design, development, production, delivery, and maintenance.
As an Amazon Associate I earn from qualifying purchases.
The Regulation entered into force on 10 December 2024. That date is not the same as the date most product requirements begin to apply. Reporting duties started earlier, on 11 September 2026; the main CRA requirements apply from 11 December 2027. The European Commission’s implementation summary describes the timetable and the scope of the rules.
Free tools Windows power users keep installed
One-click scans. No signup required.
Who needs to prepare?
The CRA’s obligations depend on both the product and the organization’s role. Manufacturers have the broadest set of duties. Importers and distributors have obligations tied to the products they place or make available on the EU market, including checking that applicable manufacturer requirements have been met. Open-source software stewards have a separate, more limited role under the Act.
#1 Best Overall
Manufacturers
A manufacturer is responsible for ensuring that a product it places on the EU market meets the applicable essential cybersecurity requirements. That responsibility includes assessing product risks, documenting compliance, arranging the required conformity assessment, providing required information, and addressing vulnerabilities during the product’s support period.
Importers and distributors
Importers and distributors should identify which products they handle and understand the checks and corrective actions required for their role. They should not assume that the manufacturer’s presence elsewhere in the supply chain removes their own CRA responsibilities.
Open-source software stewards
The Act distinguishes a commercial manufacturer placing a product on the market from an open-source software steward. A steward’s role is not automatically the same as a manufacturer’s, and not all open-source software is automatically inside or outside the CRA. The Commission’s materials explain that scope depends on whether software is made available on the market and on the actor’s role. A manufacturer placing a product with digital elements that is free and open-source software on the market is subject to manufacturer obligations. The CRA’s distinct reporting duties for open-source software stewards apply from 11 December 2027.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhich products are in scope?
The CRA generally covers products with digital elements made available on the EU market, including separately marketed components. Whether a particular item is covered depends on the Regulation’s legal scope and product characteristics. Some products are excluded or governed by other EU legislation, so a product name or the fact that it contains software is not enough by itself to settle the question.
Rank #3
The Commission’s 27 July 2026 practical guidance addresses scope questions including remote data processing, substantial modification, and free and open-source software. Organizations should use the Regulation and the current Commission guidance to assess individual products, rather than treating this overview as a product-specific legal determination.
What should manufacturers do to prepare?
A practical implementation plan starts with product classification and turns the risk assessment into evidence, controls, and operating processes. This sequence is a planning aid, not a substitute for checking the requirements that apply to a specific product category.
- Map products and roles. List the products made available in the EU, separately marketed components, the organization’s role for each, and any exclusions or sector-specific rules that may apply. Record the basis for each scope decision.
- Assess cybersecurity risks. Perform and retain a product-specific risk assessment. Use it to identify threats and appropriate controls across planning, design, development, production, delivery, and maintenance. Revisit the assessment when product changes or new vulnerabilities alter the risk picture.
- Address components and vulnerabilities. Establish how third-party components are tracked and how vulnerabilities are received, triaged, escalated, and fixed or mitigated. Define the responsibilities and handoffs needed to manage issues throughout the support period.
- Set and communicate a support period. Determine how long the product will receive security support, taking account of the product and its expected use. Make the required support-period information available to users, including the support end date.
- Prepare compliance evidence and assess conformity. Maintain the technical documentation needed to demonstrate compliance and identify the conformity assessment route for the product. Some important or critical product categories may require third-party assessment; do not assume one route fits every product.
- Complete the applicable market-access steps. Where required, complete the declaration of conformity and CE-marking steps, and provide the user information required by the Act.
- Make reporting operational. Assign owners and escalation paths for actively exploited vulnerabilities and severe incidents affecting product security. Test whether the organization can gather the facts and submit reports within the statutory time limits.
What must companies report under the CRA?
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents that affect the security of a product with digital elements. The European Commission’s reporting page sets out these deadlines:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Report stage or event | Deadline |
|---|---|
| Early warning | Within 24 hours. |
| Main notification | Within 72 hours. |
| Final report for an actively exploited vulnerability | No later than 14 days after a corrective or mitigating measure is available. |
| Final report for a severe incident | Within one month from submission of the 72-hour notification. |
Manufacturers submit one report through the CRA Single Reporting Platform. It is addressed to the CSIRT in the Member State where the manufacturer has its main establishment, with information also made available to ENISA subject to the stated exceptions. Because reporting is already in effect, organizations should not wait for the main CRA requirements to begin before setting up intake, triage, decision-making, and escalation processes.
Best Value
When do the CRA requirements apply?
| Date | What changes |
|---|---|
| 10 December 2024 | The CRA entered into force. |
| 11 June 2026 | Provisions on notification of conformity assessment bodies apply. |
| 27 July 2026 | The Commission published its first practical guidance set. The guidance is non-binding. |
| 11 September 2026 | Manufacturer reporting obligations apply; the CRA Single Reporting Platform is operational. |
| 11 December 2027 | The main CRA requirements apply. Products placed on the market earlier are subject from this date if they are substantially modified. Reporting duties also apply to products already on the market as described in the Commission’s summary. |
These dates reflect the Commission’s implementation information available on 7 October 2026. Implementation measures and guidance can change, so consult the Commission’s current CRA pages for updates.
How can the Commission’s guidance help with implementation?
The European Commission published practical, non-binding guidance on 27 July 2026 to clarify how the CRA applies. Its announcement says the guidance contains 67 practical examples, as well as use cases, flowcharts, and graphs. It gives particular attention to microenterprises and SMEs and addresses scope, substantial modification, support periods, reporting, and risk assessment.
For a team turning the law into work, those materials can help frame questions and identify where a product-specific assessment is needed. The guidance does not replace the Regulation or create a universal checklist: organizations still need to determine their role, product category, scope, and conformity route.
What should smaller organizations prioritize?
The Commission identifies support for microenterprises and SMEs as part of implementation, including training, awareness raising, information, testing, third-party conformity assessment, and regulatory sandboxes that Member States may develop. A smaller organization can make the work more manageable by assigning an owner to each product or product family, keeping scope and risk decisions documented, and establishing a reporting path before an incident occurs.
For a workshop attendee, a useful outcome is a short action register: the products to assess, the role the organization performs for each, the unresolved scope questions, the evidence to prepare, and the people responsible for vulnerability and incident reporting. That is a practical way to translate the CRA’s requirements into follow-up work without mistaking a general session for a product-specific legal assessment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
