Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe EU Cyber Resilience Act (CRA) makes cybersecurity a product lifecycle responsibility: manufacturers must assess risks, account for security in product development and production, and handle vulnerabilities during a disclosed support period. “Secure-by-design” and “bolt-on security” are useful ways to compare engineering approaches, but they are not two legal compliance categories in the Act.
What does the Cyber Resilience Act cover?
The CRA applies to hardware and software products with digital elements made available on the EU market. In general, the product’s intended purpose or reasonably foreseeable use must include a direct or indirect logical or physical data connection to a device or network. The Regulation also contains exclusions, so not every connected product or piece of software necessarily follows the same rules.
As an Amazon Associate I earn from qualifying purchases.
Products can include finished goods as well as components placed on the market separately. Whether a particular product is in scope depends on its characteristics, intended and foreseeable use, and any applicable exclusion. Product-specific determinations should be checked against Regulation (EU) 2024/2847 in the Official Journal; the European Commission’s legislative summary says it is not a systematic account of the Regulation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What secure-by-design means under the CRA
In this context, secure-by-design means treating cybersecurity risk as an input to product decisions, rather than waiting until after release to add controls. The CRA requires manufacturers to carry out a cybersecurity risk assessment and use it to determine how the essential cybersecurity requirements apply to their product. That assessment should inform planning, design, development, production, delivery and maintenance, with the compliance rationale reflected in technical documentation.
#1 Best Overall
This does not mean that every product must use the same architecture or security features. The appropriate measures depend on the product and its assessed risks. Nor does early design work remove the need for security updates, incident response or other controls after a product reaches customers.
Secure-by-design versus bolt-on security
“Bolt-on” is an engineering contrast, not a term the CRA defines or a prohibited class of security measure. It can describe an approach that relies mainly on adding fixes after core design choices have been made. Later controls can still be valuable; the weakness is relying on them alone where product risks, support commitments and pre-market conformity also need to be addressed.
| Question | Secure-by-design approach | Mostly bolt-on approach |
|---|---|---|
| When are risks assessed? | Risk assessment informs requirements and product decisions during planning and development. | Risk may be addressed mainly after a weakness or incident becomes apparent. |
| How are controls chosen? | Security requirements can shape design, development and production, informed by the product’s risk assessment. | Controls are more likely to be added to an existing product after core decisions have been made. |
| What happens after release? | Maintenance and vulnerability handling are planned as part of the product lifecycle. | Response can be predominantly reactive, without a sufficiently integrated lifecycle plan. |
| What supports a conformity decision? | Technical documentation records how relevant requirements and the risk assessment were addressed. | Late additions alone may not show how the broader product requirements were considered. |
This comparison describes engineering approaches, not a legal safe harbor. A manufacturer must meet the applicable requirements; adopting a design practice by itself does not establish compliance.
What manufacturers need to do
- Assess risk. Identify product cybersecurity risks and determine how the CRA’s essential requirements apply.
- Integrate the response. Use the assessment to guide planning, design, development, production, delivery and maintenance. Record the compliance explanation in the technical documentation.
- Complete the applicable conformity assessment before placing the product on the market. The route depends on the product’s category and applicable standards or certification options. Once conformity steps are successfully completed, prepare the EU declaration of conformity and affix CE marking as required.
- Tell users what support to expect. Determine the product’s support period, clearly disclose its end date at purchase, and provide information and instructions for secure installation, operation and use.
- Maintain vulnerability handling. Handle product and component vulnerabilities effectively during the support period and make required reports when the reporting rules apply.
The CRA does not set one universal support duration for every product in the material summarized by the Commission. The support period is a product-specific commitment, and its end date must be made clear to buyers.
Rank #3
Does every product need third-party assessment?
No. Internal control and self-assessment are generally available, but the route is not identical for every product. Important and critical product categories can face stricter requirements or conditions. For example, important class I products may use self-assessment only when stated standards, specifications or certification conditions are met; important class II and critical products require third-party assessment or an applicable European cybersecurity certification scheme.
Classification matters: check the CRA’s annexes and category definitions before assuming a route. The Commission summary describes the overall framework, but product-specific classification and the availability of standards or certification options require checking the applicable legal and implementation material.
Which organizations have duties?
- Manufacturers carry the central product duties when placing products on the market under their name or trademark, including risk assessment, conformity steps and vulnerability handling.
- Importers must verify key manufacturer steps before placing products on the market and cooperate as required.
- Distributors must check CE marking and certain supplied information, and cooperate when risks arise.
- Qualifying open-source software stewards have a separate, tailored role. This can apply to a legal person that supports specific commercial free or open-source software on a sustained basis; it is not the same set of duties as a manufacturer’s.
When do the CRA requirements apply?
| Date | What applies |
|---|---|
| 10 December 2024 | The Regulation entered into force. |
| 11 June 2026 | Chapter IV provisions on notifying conformity-assessment bodies apply. |
| 11 September 2026 | Article 14 reporting obligations apply. The Commission says reporting covers actively exploited vulnerabilities and severe incidents affecting product security, including products already made available on the Union market. |
| 11 December 2027 | The main CRA obligations apply. Under the Commission summary, products made available before this date become subject to the main rules from that date if they are substantially modified. |
The European Commission announced on 27 July 2026 that new practical guidance addresses product scope, substantial modification, support periods, reporting and risk assessment, with 67 practical examples. That announcement describes guidance, not a replacement for the Regulation or a product-specific legal determination.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How vulnerability and incident reporting works
From 11 September 2026, the reporting timetable described by the Commission distinguishes an initial warning from later, fuller reports. Notifications go through ENISA’s CRA Single Reporting Platform and are addressed to the relevant CSIRT, with ENISA receiving the information under the described process.
Best Value
- Within 24 hours of awareness: send an early warning.
- Within 72 hours: submit the main notification.
- Actively exploited vulnerability: submit a final report within 14 days after a corrective or mitigating measure is available.
- Severe incident: submit a final report within one month of the 72-hour notification.
These reporting duties sit alongside the longer-term obligation to handle vulnerabilities during the product’s support period; reporting an event does not replace corrective action.
What “compliance” does not mean
- It does not mean a single security design pattern guarantees compliance.
- It does not ban post-release fixes or other reactive security measures.
- It does not mean every in-scope product follows one conformity-assessment route.
- It does not establish that a product is immune to vulnerabilities or incidents.
The legal text and applicable implementing material govern a particular product’s obligations. The Commission’s summaries and guidance help explain the framework, but scope exclusions, classifications, standards status and assessment routes can depend on the facts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
