Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe EU Cyber Resilience Act (CRA) already requires reporting of certain product-security vulnerabilities and incidents, even though most product-design and conformity obligations do not apply until 11 December 2027. Irish businesses should start by mapping the products they make available in the EU, identifying their legal role for each product, and preparing both for reporting and for the later product requirements. Being Irish—or being a technology company—does not by itself decide whether the CRA applies.
Does the CRA apply to your product?
The CRA is Regulation (EU) 2024/2847, an EU-wide law covering products with digital elements made available on the EU market. Its scope is product-specific: it depends on what the product is, its intended purpose or reasonably foreseeable use, how it connects to other devices or networks, and whether an exclusion applies. A company can have some products in scope and others outside it.
As an Amazon Associate I earn from qualifying purchases.
Check the product and its connections
A product may be in scope if its intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. The category includes hardware and software, and can include qualifying remote data processing solutions. A component placed separately on the market may also be covered; do not assess only the finished device or application.
Making a product available in commercial activity is relevant even if it is supplied free of charge. The European Commission’s summary of the CRA and the Regulation itself set out the scope and exclusions. Some products are excluded, including certain products covered by other EU legislation, so test the exact product against the legal text rather than assuming that an app, embedded software, cloud service or connected device is automatically covered or exempt.
#1 Best Overall
Do not treat all SaaS or open-source software alike
A software product’s relationship to a device or network, its market activity and any remote processing it relies on can affect the analysis. The label “SaaS” does not settle the question. The Commission’s non-binding guidance, published on 27 July 2026, addresses scope questions including remote data processing and open-source software and includes 67 practical examples, according to the Commission’s announcement. It is an interpretive aid, not binding law.
Which CRA role does your business have?
The legal duties vary with the role a business performs. The principal product obligations fall on manufacturers, but importers and distributors also have duties. A company may need to assess its role product by product and across its supply chain.
Manufacturer
For CRA purposes, the manufacturer is the person or company that develops, or has developed, a product and places it on the market under its own name or trademark. Manufacturers carry the main responsibility for meeting the product requirements, including risk assessment, vulnerability handling, technical documentation and conformity assessment.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Importer and distributor
Importers and distributors have their own obligations, including checking relevant compliance and product information, cooperating with authorities and taking corrective action where required. They should establish how they will obtain evidence and instructions from manufacturers, and what escalation process applies if a product appears non-compliant or presents a risk.
Open-source steward
A legal person that provides sustained, systematic support for qualifying free and open-source software intended for commercial activity may fall within the CRA’s separate definition of an open-source steward. Open-source code is not all exempt, and an individual contributor or occasional maintainer does not automatically become a steward. Apply the legal definition to the organisation’s actual role and support activity.
What is already in force, and what comes later?
The CRA entered into force on 10 December 2024, but its provisions have different application dates. The European Commission’s implementation summary identifies the following dates:
| Date | What applies |
|---|---|
| 10 December 2024 | The CRA entered into force. |
| 11 June 2026 | Provisions on notification of conformity-assessment bodies apply. |
| 11 September 2026 | Article 14 reporting obligations apply; the Commission says the ENISA Single Reporting Platform is operational. |
| 11 December 2027 | The main product obligations apply. |
The September 2026 reporting date is not postponed by the later date for most product obligations. The Commission says Article 14 reporting covers products made available on the EU market before 11 December 2027 as well as those made available after it. A business should therefore check its existing EU-facing products, not just its next product launch.
When do CRA reporting rules start, and what must be reported?
Article 14 reporting has applied since 11 September 2026. The Irish National Cyber Security Centre (NCSC), on its CRA page last updated that date, describes the reportable cases as actively exploited vulnerabilities and severe incidents affecting product security. The duty is tied to the manufacturer and the affected product; it is not a general requirement to report every security flaw or every incident involving a company.
Reporting deadlines described by the Irish NCSC
| Report stage | Deadline | Trigger or detail |
|---|---|---|
| Early warning | Within 24 hours | From the manufacturer becoming aware of the actively exploited vulnerability or severe incident. |
| Detailed notification | Within 72 hours total from awareness | Due within 48 hours after the early warning, as described by the NCSC. |
| Final report: actively exploited vulnerability | No later than 14 days | After a corrective patch or workaround becomes available. |
| Final report: severe incident | Within one month | After the detailed notification. |
These are the staged periods set out by the Irish NCSC; use the Regulation and current official instructions when determining how a particular event and its reporting clock apply.
Where an Irish manufacturer files
Reports go through ENISA’s CRA Single Reporting Platform (SRP). The Commission says the SRP routes a report to the CSIRT for the Member State where the manufacturer has its main establishment and makes it available to ENISA; the initial CSIRT shares it with other relevant Member State CSIRTs. For an Irish manufacturer, the main-establishment location therefore affects routing, but the SRP remains the submission route.
The NCSC says only filings through the SRP satisfy the statutory reporting requirement. It describes an emergency email fallback only for a period when ENISA declares the platform offline; a formal notification must then be filed in the SRP once it is available. Establish who in the company can submit a report and rehearse the escalation path before a reportable event occurs.
What manufacturers need to prepare before December 2027
The Commission’s summary describes a lifecycle approach: manufacturers assess cybersecurity risk and use that assessment to implement the CRA’s essential requirements across planning, design, development, production, delivery and maintenance. Its summary also sets out documentation, component due diligence, conformity and product-information duties.
Build a product-level readiness plan
- Inventory EU-facing products and components. Include software, hardware, separately placed components and relevant remote processing. Record where and how each is made available, including free supply in commercial activity.
- Assign the legal roles. Identify the manufacturer, importer and distributor for each product, and assess whether a legal person’s open-source support activity meets the steward definition.
- Document scope and exclusions. Record the product’s intended purpose, reasonably foreseeable use, connections and any relevant exclusion. Escalate uncertain product-boundary questions for legal review.
- Map dependencies and component risks. Manufacturers must exercise due diligence on integrated third-party components. Keep a usable record of dependencies, the risks considered and the measures selected.
- Set up vulnerability handling. Establish channels to receive vulnerability reports, assess and prioritise them, prepare patches or workarounds, and escalate potential Article 14 cases. Manufacturers remain responsible for vulnerability handling throughout a product’s full operational lifecycle, according to the Irish NCSC.
- Set and communicate a support period. Give users clear information about the end of the product’s support period alongside the required identifying, manufacturer-contact and instruction information.
- Retain compliance evidence. Maintain the risk assessment and selected technical measures in technical documentation that can be made available to market-surveillance authorities.
- Choose the conformity route before launch. Classify the product, check applicable standards or certification schemes, and allow time for any required third-party assessment.
- Rehearse the reporting route. Confirm who owns SRP access, internal decision-making and submissions, and how the process works if the platform is officially declared offline.
Which conformity-assessment route applies?
There is no single route for every product. Under the Commission’s summary, the available route depends on product classification and on whether specified standards, common specifications or an applicable European cybersecurity certification scheme can be used. A product-specific classification is necessary before choosing a route.
| Product category | Route described by the Commission |
|---|---|
| Products not subject to the additional important- or critical-product route | Manufacturers generally choose internal control (self-assessment), assessment by a notified body, or an applicable European cybersecurity certification scheme. |
| Important class I | Self-assessment is available only under the specified standards, common-specification or certification conditions. Otherwise, third-party assessment is required. |
| Important class II | Third-party assessment or an applicable European cybersecurity certification scheme is required. |
| Critical products | Third-party assessment or an applicable European cybersecurity certification scheme is required. |
Once the relevant conformity procedure is successfully completed, manufacturers draw up the EU declaration of conformity and affix CE marking before placing the product on the market. Do not budget or plan on self-assessment until the classification and conditions for the specific product are clear.
What to watch on standards and guidance
The Commission’s implementation tracker listed first standardisation deliverables for Q3 2026 and further deliverables for 30 October 2027. Those are implementation milestones, not proof that every final harmonised standard has already been published or applies to a particular product. Check the current status before claiming that a standard is harmonised or that it gives a presumption of conformity.
Recommended Free Tools
The Commission’s 27 July 2026 guidance is expressly non-binding. Its stated topics include scope, substantial modification, support periods, reporting and risk assessment, with attention to microenterprises and SMEs. Use it alongside the binding Regulation and current official instructions; where classification, exclusions or remote-processing arrangements are unclear, the guidance does not replace product-specific legal analysis.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
