The EU Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847, a directly applicable law setting cybersecurity requirements for products with digital elements, including software products that meet its scope. Its key dates are already staged: conformity-assessment-body rules applied from 11 June 2026, manufacturer reporting duties began on 11 September 2026, and the Regulation generally applies from 11 December 2027. For software manufacturers, preparation means addressing security across a product’s lifecycle—not just adding a final compliance check.
What the Cyber Resilience Act covers
The CRA is a European Union regulation adopted on 23 October 2024 and published in the Official Journal on 20 November 2024. It aims to address vulnerabilities in products with digital elements and gaps in security updates over those products’ lifecycles. As a regulation, it applies directly in Member States.
As an Amazon Associate I earn from qualifying purchases.
The scope includes software as well as relevant hardware, but “software” alone does not settle whether a particular offering is covered. The product definition, intended purpose, whether it is placed on the market, applicable exclusions, and interactions with other EU product-safety rules can all matter. A product-specific scope analysis is necessary; this guide is not a legal classification.
Keep the three key dates separate
| Date | What applies | Practical significance |
|---|---|---|
| 11 June 2026 | Chapter IV, Articles 35–51, on conformity assessment bodies. | This is an earlier institutional milestone, not the general application date for all manufacturer duties. |
| 11 September 2026 | Article 14 reporting obligations for actively exploited vulnerabilities and severe incidents having an impact on product security. | These reporting duties are in effect as of October 2026, even though the Regulation’s general application date is later. |
| 11 December 2027 | The Regulation generally applies. | Products placed on the market before this date are generally subject to the Regulation only if substantially modified from that date, subject to Article 69’s specific exception for Article 14 reporting. |
These dates are set by Articles 69 and 71 of Regulation (EU) 2024/2847. The earlier dates should not be treated as postponing Article 14 obligations until December 2027.
#1 Best Overall
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
What software manufacturers need to put in place
The CRA frames product cybersecurity as a lifecycle responsibility. Annex I, Part I, point 1 states: “Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks.” In practice, relevant manufacturer work includes:
- Risk-based security: assess cybersecurity risks and use the assessment to inform design, development, production, and maintenance.
- Secure product properties: products within scope must meet applicable Annex I requirements, including requirements concerning known exploitable vulnerabilities and secure-by-default configurations, subject to the precise qualifications in the Regulation.
- Vulnerability handling: maintain processes to identify, document, and address vulnerabilities during the support period; provide security updates and support coordinated vulnerability disclosure.
- Component information: maintain technical documentation and component information. The Regulation refers to a machine-readable software bill of materials (SBOM); its precise obligation and access conditions depend on the text.
- Support transparency: provide users with the support-period information and other information the Regulation requires, so they can make informed purchasing and use decisions.
The details depend on the manufacturer’s role and the product’s status. A checklist cannot determine whether a product is covered or establish all duties that apply to it.
Rank #2
- Hardware-Rooted Security with PUF Technology – PUFido Drive Clife Key uses Physical Unclonable Function technology to generate a unique, hardware-based identity that cannot be duplicated, delivering stronger resistance against tampering and cyber attacks than conventional security keys.
- FIDO2 Certified Phishing-Resistant Protection – Fully compliant with FIDO2/U2F standards, enabling secure passwordless login and two-factor authentication to help protect accounts from phishing and credential theft.
- Security Key + Flash Drive in One Device – Combines a FIDO security key with a built-in USB flash drive, allowing you to carry files and a hardware authentication key together in a single compact device.
- Easy to Use & Portable – Compact USB-C design fits easily on a keychain or in a pocket. Simply plug in the Drive Clife Key to authenticate or access stored files with no extra software required.
- Universal Compatibility – Works with hundreds of FIDO2/U2F compatible services and supports Windows, macOS, Linux, iOS, Android, and other major platforms.
How Article 14 reporting deadlines work
Article 14 applies from 11 September 2026. Its deadlines run from when the manufacturer becomes aware of the specified vulnerability or incident, and the final-report deadline depends on which type of event is being reported. Reports go simultaneously to the designated CSIRT coordinator and ENISA through the single reporting platform.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Event | Early warning | Notification | Final report |
|---|---|---|---|
| Actively exploited vulnerability | Without undue delay and no later than 24 hours after awareness. | Vulnerability notification without undue delay and no later than 72 hours after awareness. | No later than 14 days after a corrective or mitigating measure is available. |
| Severe incident having an impact on product security | Without undue delay and no later than 24 hours after awareness. | Incident notification without undue delay and no later than 72 hours after awareness. | Within one month after submission of the incident notification. |
The 14-day and one-month periods have different starting points. A reporting workflow should therefore record not only when the manufacturer became aware of an event, but also when a corrective or mitigating measure becomes available or when the incident notification is submitted, as applicable.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Conformity assessment depends on the product category
The CRA provides different conformity-assessment procedures depending on product category and applicable requirements. It identifies important and critical product classes, with routes that can involve standards, notified bodies, or other procedures specified in the Regulation. It does not follow that every software product needs third-party certification. Use the official legal text to identify a product’s category and applicable route; verify current official standards and implementation materials rather than assuming a particular standard is harmonised or a route is available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical readiness sequence for software teams
- Inventory EU offerings. Record each product made available in the EU, its manufacturer, intended purpose, delivery method, and relevant integrations.
- Assess scope and classification. For each offering, evaluate whether it is a product with digital elements, whether an exclusion or sector-specific regime may apply, and whether it belongs to an important or critical category.
- Map components and suppliers. Establish how component information is maintained and whether an SBOM process is required for the product.
- Connect risk assessment to engineering. Document cybersecurity risks and link them to design, testing, release, and maintenance controls.
- Establish vulnerability and update operations. Define intake, coordinated disclosure, remediation, security-update, and user-notification processes.
- Set and communicate the support period. Make the support-period information and other required user information available for the product.
- Prepare the Article 14 response path. Name a decision owner, define how awareness and event timing are recorded, and prepare a route for reports through the single reporting platform.
- Determine the conformity route. Identify the procedure applicable to each product category and monitor official standards and implementation materials.
This sequence is an operational way to organize the work, not a substitute for product-specific legal assessment. The Regulation’s text controls the duties, dates, classifications, and procedures.
Quick Recap
Rank #4
![Thetis Pro FIDO2 Security Key Passkey with Complex Pin [PinPlex], Hardware Device Supports USB A, Type C &NFC, TOTP/HOTP Authenticator APP, PIV Certificates, FIDO 2.0 Two Factor Authentication 2FA MFA](https://m.media-amazon.com/images/I/31ugrBqG6SL._SL160_.jpg)
- Dual USB-A and USB-C Security Key – Features both USB-A and USB-C connectors for seamless compatibility across desktops, laptops, and tablets. Supports plug-and-stay use or keychain carry.
- NFC-Enabled for Mobile Access – Built-in NFC allows fast, wireless authentication with Android and iPhone devices. Ideal for mobile logins and on-the-go security.
- FIDO Certified for Strong Authentication – [CHECK COMPATIBILITY before purchase] Fully compliant with FIDO2 and FIDO U2F standards. Works with major platforms like Google, Microsoft, GitHub, and Dropbox.
- Passwordless Login with PinPlex – Supports secure passkey login via WebAuthn and CTAP2 with added protection from PinPlex, a complex PIN system that enhances physical security.
- Multi-Layer Authentication Support – Includes PIV certificates and supports both TOTP and HOTP for strong 2FA/MFA coverage across enterprise and consumer apps.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
