Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The EU Cyber Resilience Act (CRA) has two deadlines that businesses must not confuse. The first, September 11, 2026, started manufacturer reporting duties for actively exploited vulnerabilities and severe product-security incidents. The main compliance date is December 11, 2027, when the broader cybersecurity, documentation, conformity-assessment and CE-marking requirements apply.
As of September 22, 2026, the reporting deadline has passed, but the larger compliance program is still ahead. Any company making qualifying hardware or software available in the EU should now have an operational Article 14 process and a documented plan for full compliance.
What the Cyber Resilience Act actually regulates
The CRA is a product-security regulation for products with digital elements placed on the EU market. It is not simply a general cybersecurity-management framework like a broad GRC or information-security standard.
Free tools Windows power users keep installed
One-click scans. No signup required.
Its scope can include software, hardware, firmware, connected consumer devices, industrial and operational-technology products, network and security products, mobile applications tied to a product, and manufacturer-controlled APIs, databases or cloud functions that are integral to a product.
#1 Best Overall
A product may be covered when it has a direct or indirect logical or physical connection to a device or network. A pure cloud service is not automatically a CRA product, but calling a service “SaaS” does not settle the question. A remote data-processing solution can fall within scope when it was designed or developed by or for the product manufacturer and the product cannot perform one of its functions without it. The European Commission’s 2026 implementation guidance provides useful examples, but it is non-binding; Regulation (EU) 2024/2847 controls.
The CRA timeline
| Date | What it means |
|---|---|
| December 10, 2024 | The regulation entered into force. |
| June 11, 2026 | Rules concerning notification of conformity-assessment bodies began applying. |
| September 11, 2026 | Manufacturer reporting duties under Article 14 began. |
| December 11, 2027 | The main CRA obligations apply, including product-security requirements, vulnerability handling, technical documentation, conformity assessment, declarations of conformity and CE marking. |
The September date was not a deadline for every company to complete full CRA certification, publish a particular type of SBOM or finish every technical file. It was the start of a specific reporting obligation. However, a business that waited until September to build product inventories, vulnerability triage and escalation procedures was taking a serious operational risk.
What changed on September 11, 2026?
From that date, manufacturers must report qualifying:
- Actively exploited vulnerabilities contained in their products.
- Severe incidents affecting the security of their products.
These duties apply to in-scope products placed on the market before December 11, 2027 as well as newer products. A product released before the main CRA application date is therefore not automatically outside Article 14.
Actively exploited vulnerabilities
When a manufacturer becomes aware of an actively exploited vulnerability contained in its product, it must generally:
- Submit an early warning without undue delay and within 24 hours.
- Submit a fuller vulnerability notification within 72 hours, unless the relevant information was already provided.
- Submit a final report no later than 14 days after a corrective or mitigating measure becomes available.
The report is submitted through the CRA Single Reporting Platform to the relevant coordinating CSIRT and ENISA. ENISA describes the platform as the centralized electronic reporting channel; see its Single Reporting Platform information.
Severe incidents
For a severe incident affecting product security, the manufacturer generally must:
- Submit an early warning within 24 hours of becoming aware of the incident.
- Submit an incident notification within 72 hours.
- Submit a final report within one month after the incident notification.
An incident may be severe where it negatively affects, or could negatively affect, the product’s ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions. It may also qualify where malicious code has been, or could be, introduced into or executed in the product or a user’s network and information systems.
The difficult operational question is often not whether a form can be filed within 24 hours. It is when the manufacturer became aware of the relevant event. Companies should preserve timestamps for intake, technical confirmation, escalation and reporting decisions.
Not every CVE is automatically an Article 14 report. Teams must determine whether the vulnerability is contained in the company’s product and whether it is actively exploited. Likewise, the September obligation does not require every company to use a particular commercial scanner.
Does the CRA apply to your company?
Start with these questions:
- Do you make hardware or software available on the EU market?
- Does the product connect directly or indirectly to a device or network?
- Does a manufacturer-controlled API, database or cloud function provide an essential product capability?
- Do you import, distribute, rebrand or substantially modify another company’s product?
- Is the product an important or potentially critical cybersecurity category?
- Are you maintaining open-source software intended for commercial integration?
The answer may differ by product. A company can have ordinary software products, important security products and out-of-scope hosted services at the same time. Build the analysis at product level rather than assuming that one company-wide label—“SaaS,” “open source” or “cloud provider”—settles the issue.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Non-EU companies
The relevant question is generally whether an in-scope product is made available on the EU market, not where the company is incorporated. US and other non-EU vendors should map their importers, distributors, authorized representatives and market-access responsibilities. The absence of an EU subsidiary does not by itself remove CRA exposure, although the exact duties depend on the product and supply-chain role.
Importers, distributors and modifiers
Importers and distributors must perform checks before making products available, including checks concerning conformity procedures, technical documentation, CE marking, declarations and required information.
An importer or distributor can become subject to manufacturer obligations if it sells a product under its own name or trademark or carries out a substantial modification. A party that substantially changes a product already placed on the market may be treated as the manufacturer of the modified product. The obligation can apply to the affected part or, where cybersecurity is affected across the product, potentially to the whole product.
Open-source software
Non-monetized, non-commercial free and open-source activity is treated differently from commercial products. That does not mean all open-source software or all maintainers are exempt. Entities that provide sustained support for commercially intended open-source products may qualify as open-source software stewards and face a tailored regime.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRelevant facts include monetization, commercial intent, sustained support, the maintainer’s role and whether the software is intended for integration into commercial products. Both “open source is always exempt” and “every maintainer has full manufacturer duties” are overbroad conclusions.
What must be ready by December 11, 2027?
The main CRA obligations require manufacturers to treat cybersecurity as a product lifecycle responsibility. Among other things, manufacturers must:
- Design, develop and produce products with an appropriate risk-based level of cybersecurity.
- Conduct and document a cybersecurity risk assessment.
- Maintain vulnerability-handling and coordinated-vulnerability-disclosure processes.
- Provide security updates during the support period.
- Prepare technical documentation.
- Complete the applicable conformity-assessment procedure.
- Draw up an EU declaration of conformity.
- Affix the CE marking where required.
- Provide security instructions, a vulnerability-reporting contact and the support-period end date.
- Take corrective action, withdraw or recall products where necessary.
1. Build a product and market inventory
For every product, record its name and version, hardware and software components, EU availability, legal manufacturer, importer and distributor relationships, authorized representative, integrated remote services, third-party and open-source components, intended users, existing conformity evidence and planned substantial modifications.
Also record whether the product is ordinary, important Class I, important Class II or potentially critical, and identify its current or proposed support end date.
2. Perform a documented risk assessment
The assessment should connect the actual architecture and intended use to the CRA requirements. Cover foreseeable misuse, authentication, access control, default configurations, secrets, update mechanisms, cryptography, network exposure, confidentiality, integrity, supply-chain dependencies, remote services and safety or operational consequences.
“Risk-based” does not mean informal. The assessment should be reproducible, versioned, approved and linked to design choices, tests, residual risks and mitigations.
3. Create vulnerability intake and disclosure processes
Maintain a monitored vulnerability-reporting channel and a coordinated-vulnerability-disclosure policy. Define:
- Who monitors incoming reports.
- How reports are acknowledged and logged.
- Severity and exploitability criteria.
- How product-specific impact is determined.
- How engineering, legal, communications and management are escalated.
- When an issue becomes an Article 14 event.
- How customers are notified.
- How remediation and final reports are tracked.
User-facing information must identify a vulnerability-reporting contact and provide information about the manufacturer’s disclosure policy.
4. Make SBOMs operational
A product-level software bill of materials should let the company identify direct and transitive dependencies, component versions, suppliers, affected product releases and available fixes. It should be linked to release engineering and vulnerability triage.
An SBOM is not the same as CRA compliance. A stale or incomplete SBOM cannot prove that a product is secure, that vulnerabilities are handled, or that conformity assessment is complete. The useful test is whether the company can move from a component vulnerability to an affected product, determine exploitability, select a mitigation and preserve evidence for the decision.
5. Decide and fund the support period
The manufacturer must determine a support period based on expected use, reasonable user expectations, the product’s nature, relevant law, the operating environment and comparable products. It is generally at least five years, unless the product is expected to be used for less than five years.
The support end date, including at least the month and year, must be clearly stated at purchase. Security updates made available during the support period must remain available for at least 10 years after issuance or for the remainder of the support period, whichever is longer.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →This is a business and engineering commitment. It affects patch infrastructure, staffing, customer communications, component choices and the cost of supporting legacy products.
6. Assemble the technical file continuously
The technical documentation should cover, as applicable:
- Product description and intended purpose.
- Architecture and interfaces.
- Cybersecurity risk assessment.
- Security requirements and design decisions.
- Testing and validation evidence.
- Vulnerability-management procedures.
- Component and dependency information.
- Applied standards or alternative technical specifications.
- Support-period reasoning.
- Conformity-assessment records.
- EU declaration of conformity.
- User instructions and security information.
Required information and documentation must generally be retained for at least 10 years after the product is placed on the market or for the support period, whichever is longer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Will you need a notified body?
The conformity route depends on product classification and the applicable standards or cybersecurity certification schemes.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteOrdinary products
Products that are not important or critical may generally use the manufacturer’s internal-control conformity-assessment procedure when the relevant requirements are met.
Important Class I products
Class I includes certain products whose core functionality is important to cybersecurity or whose compromise could create significant adverse effects. Self-assessment may be available when the manufacturer applies relevant harmonized standards, common specifications or an applicable European cybersecurity certification scheme. If those routes are not used, third-party assessment is required.
Important Class II products
Class II products require third-party involvement even where relevant standards or schemes are applied. Cybersecurity-related categories can include certain authentication and access-control products, endpoint-security products, intrusion-prevention or intrusion-detection products and network-protection products. Firewalls and intrusion-detection or intrusion-prevention systems are examples identified in the regulation’s explanatory material.
Critical products
Critical products can face stronger requirements, including possible mandatory European cybersecurity certification where the relevant scheme exists and the Commission adopts the necessary measure. A “critical” label does not mean every such product has identical certification obligations on the same date; the applicable delegated acts and schemes matter.
Standards can provide a presumption of conformity for covered requirements, but using one standard does not automatically satisfy every CRA duty. Manufacturers must still address uncovered requirements and document how compliance is achieved.
A practical readiness plan
Immediately: stabilize Article 14 operations
- Appoint an accountable executive and a product-security owner.
- Maintain a 24/7 contact or escalation rota for qualifying events.
- Define who can authorize an early warning using incomplete information.
- Timestamp when the company receives, validates and escalates an event.
- Maintain product and version inventories.
- Link vulnerabilities and components to affected products.
- Define “actively exploited,” “contained in the product,” “severe” and “aware.”
- Prepare 24-hour, 72-hour and final-report templates.
- Identify the applicable coordinating CSIRT and reporting route.
- Run a tabletop exercise and preserve the results.
Within 90 days: close structural gaps
- Generate product-level SBOMs and link them to releases.
- Complete initial CRA scope and classification decisions.
- Document the support period for each product.
- Map technical-file gaps.
- Review secure-update design, signing and emergency mitigation options.
- Start conformity-assessment planning.
- Reserve notified-body capacity where third-party assessment may be required.
- Map contractual responsibility between manufacturers, cloud providers, importers and distributors.
Before December 11, 2027
- Complete design and process remediation.
- Finalize technical documentation.
- Complete the applicable conformity assessment.
- Issue the EU declaration of conformity.
- Apply CE marking where required.
- Publish security information and support-period end dates.
- Operationalize post-market monitoring, updates, corrective action, withdrawal and recall processes.
Penalties and enforcement
The CRA sets maximum administrative-fine levels, while Member States establish penalties and enforcement mechanics. The maximums include:
- Up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaches involving essential cybersecurity requirements and Articles 13 and 14.
- Up to €10 million or 2% of worldwide annual turnover, whichever is higher, for specified other obligations.
- Up to €5 million or 1% of worldwide annual turnover, whichever is higher, for supplying incorrect, incomplete or misleading information to notified bodies or market-surveillance authorities.
These are statutory maximums, not automatic penalties. Authorities consider factors such as gravity, duration, consequences, prior enforcement and company size. Corrective or restrictive measures can also apply. Certain deadline-related provisions concern microenterprises, small enterprises and open-source software stewards, but they are not blanket exemptions from the CRA.
Should you buy a CRA platform?
Tools can help organize evidence, SBOMs, vulnerabilities, controls and deadlines, but no platform independently resolves legal classification, substantial modification, product scope, conformity route or notified-body requirements.
Recommended Free Tools
When evaluating a tool, ask whether it can:
- Maintain a product and version inventory.
- Connect SBOMs to released product versions.
- Track vulnerabilities through triage, remediation and evidence.
- Distinguish a generic CVE from active exploitation in the company’s product.
- Timestamp awareness and escalation.
- Support 24-hour and 72-hour reporting workflows.
- Store technical documentation and conformity evidence.
- Track support periods and update commitments.
- Handle hardware, firmware and embedded components.
- Export evidence for auditors, notified bodies or market-surveillance authorities.
A purpose-built CRA platform may suit a small software company. Developer-focused tools such as SCA and code scanners can improve dependency visibility. Enterprise SCA products can help larger embedded and software organizations manage SBOMs. Broad GRC platforms can coordinate CRA evidence with SOC 2, ISO 27001 or other frameworks. None should be presented as a substitute for engineering work, legal analysis or formal conformity assessment.
Quick Recap
Common mistakes to avoid
- Waiting until 2027: the reporting process should already be operating.
- Assuming every vulnerability is reportable: Article 14 has specific triggers involving actively exploited vulnerabilities and severe incidents.
- Treating an SBOM as compliance: visibility is evidence and an operational input, not the complete legal outcome.
- Assuming the cloud provider owns all responsibility: integral remote-processing architecture and manufacturer control matter.
- Assuming self-assessment is always available: Class II products require third-party assessment.
- Promising indefinite support: support commitments must be realistic, documented and funded.
- Assuming the importer is always the manufacturer: branding and substantial modification can change the legal role.
- Treating Commission guidance as law: the guidance is useful but non-binding.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
