Business & IT Consultant
The Cyber Resilience Act (CRA) is an EU regulation that establishes mandatory minimum cybersecurity requirements for products with digital elements and holds manufacturers, importers, and distributors accountable throughout the entire product lifecycle. This practical guide explains which companies and products are affected, what obligations manufacturers must fulfill, and how the CRA requirements can be implemented step by step in practice.
The Cyber Resilience Act (CRA) is the first European regulation to establish binding minimum cybersecurity requirements for products with digital elements available on the EU market. The CRA applies to all products with digital elements that are manufactured, imported, or distributed in the EU and that are made available in the course of an economic activity.
The Cyber Resilience Act requires manufacturers, importers, and distributors to design and operate connected products securely throughout their entire lifecycle. The goal is to reduce systemic cybersecurity risks in the EU internal market and to clearly assign responsibility along the supply chain.
The CRA has been in effect since the end of 2024. Starting September 11, 2026, reporting requirements for exploited vulnerabilities will apply, and as of December 11, 2027, only CRA-compliant products will be permitted.
This guide helps companies understand the Cyber Resilience Act and implement the necessary steps. It provides an initial overview of the company’s role, affected products, and required measures. Free and no personal information required!
This guide helps companies understand the Cyber Resilience Act and implement the necessary steps. It provides an initial overview of the company’s role, affected products, and required measures. Free and no personal information required!
The Cyber Resilience Act applies to software products and products with digital elements that are newly placed on the EU market or substantially modified. For products already on the market, the reporting requirements for vulnerabilities and security incidents apply in particular.
Excluded are open-source software that is not provided as part of a commercial activity, certain products subject to specific EU regulations, and other specifically defined exceptions under Article 2 of the CRA.
The CRA thus applies to a wide range of products. Here are a few examples:
A list of various products containing digital elements can be found in Annexes II and III of the CRA.
The CRA is significant not only for manufacturers but also for the entire supply chain and all stakeholders in the EU’s digital product market. The Cyber Resilience Act applies to:
Digitalization, new market demands, and changing regulatory requirements are forcing companies to continually rethink their business models, processes, and structures. We support you in this process with strategic foresight, methodological clarity, and the ability to put ideas into practice.
Since manufacturers bear the actual responsibility for decision-making and product liability, they are at the center of the obligations under the Cyber Resilience Act. According to the CRA, a manufacturer is “a natural or legal person who develops or manufactures products with digital elements, or who has products with digital elements designed, developed, or manufactured and markets them under their name or brand, whether for payment, for monetization, or free of charge.”
In other words, a manufacturer is a company that produces digital products itself or has them produced and offers them under its own name or brand. It does not matter whether the product is sold, whether it generates indirect revenue, or whether it is provided free of charge.
Manufacturers share responsibility for all components used in their products. This means that if a manufacturer uses third-party components—such as software libraries, modules, or open-source software, they must verify that these components are secure—even if they are free, open-source, or not marketed by the manufacturer itself. A manufacturer cannot, therefore, claim that the component originated from someone else.
Manufacturers should fulfill their duty of care by exercising due diligence when integrating third-party components and by appropriately assessing their cybersecurity risks. The thoroughness of the assessment depends on how risky the component is. The higher the security risk, the more carefully the manufacturer must proceed.
Typical assessments include, for example:
The minimum requirements for manufacturers include mandatory compliance with cybersecurity measures throughout the entire product lifecycle —including planning, development, manufacturing, delivery, and maintenance. The step-by-step process is explained below:
1. Determine the product category of the affected products
For affected products, it must be determined whether they are classified as an essential Class I or II product in accordance with Annex III or as a critical product in accordance with Annex IV of the CRA. Products that do not fall into either of these categories are subject to the general requirements of the CRA. The conformity assessment procedure changes specifically for these products because they may have potential implications for the economy and public safety.
These examples are provided for illustrative purposes only. The product categories listed in Annexes III and IV of the CRA are the sole basis for legal classification.
2. Prepare a Declaration of Conformity
A Declaration of Conformity is required to demonstrate that the product meets all requirements of the CRA. The applicable conformity assessment procedure depends on the product category—as described in Step 1. For most products, this involves a self-assessment by the manufacturer; for a few, it requires an assessment by a notified third-party body. Manufacturers issue the EU Declaration of Conformity after all relevant requirements have been met and documented.
3. Report Safety Incidents
Manufacturers are required to:
This obligation also applies to products already on the market.
In the case of actively exploited vulnerabilities and serious security incidents affecting the security of products with digital elements, an early warning must be issued within 24 hours. A full report must be submitted within 72 hours, followed by the respective final report as required. Reports are submitted via the new central reporting platform established by the European Union Agency for Cybersecurity (ENISA).
4. Regular Updates
Throughout the entire support period, security updates must be made available to end users, and vulnerabilities must be managed. Manufacturers must provide users with clear information regarding the update and support periods. The support period must reflect the product’s expected useful life and shall generally be at least five years. If the product is expected to be used for less than five years, the support period may correspond to this shorter useful life. The duration must not be unreasonably short and must be communicated transparently to users.
5. Documentation and Instructions
Manufacturers must provide users with clear information on safe use and, upon request, provide market surveillance authorities with all necessary information. In addition, the CRA requires the creation of a Software Bill of Materials (SBOM). The SBOM describes which components are used in the product. The SBOM serves as a key foundation for vulnerability management, incident response, and market surveillance. The CRA mandates the creation of an SBOM, but it does not have to be published.
6. Security by Design
The CRA’s requirements should be taken into account as early as the product development phase, and the mandatory handling of product vulnerabilities should be considered.
Connected products must be designed with cybersecurity in mind, for example, by ensuring that data stored or transmitted by the product is encrypted. The default settings of connected products must contribute to enhancing their security, for example by prohibiting weak default passwords or by automatically installing security updates.
The technical documentation serves as proof that a product has been developed securely in accordance with the Regulation. It must be complete at the time of market introduction and made available upon request by the market surveillance authority.
Products with digital elements that are subject to the CRA must undergo the required conformity assessment before being placed on the market and must bear the CE marking.
The greatest risks often arise from decisions whose consequences for
security, compliance, and operations only become apparent later on. We help you
answer the right questions before decisions turn into costly
challenges.
The Cyber Resilience Act provides for different fines depending on the type of violation. Violations of basic security requirements can result in fines of up to 15 million euros or 2.5 percent of annual revenue.
Violations of formal or organizational obligations are punishable by fines of up to 10 million euros or 2 percent of annual revenue, while providing false information to authorities can result in fines of up to 5 million euros or 1 percent of annual revenue.
When determining the specific amount, the competent authorities take into account, among other things:
Affected companies can properly prioritize measures by:
The Cyber Resilience Act makes cybersecurity a mandatory requirement throughout the entire lifecycle of digital products. Companies should therefore identify their affected products early on, determine product categories and compliance procedures, and establish processes for updates, vulnerability management, reporting, and documentation. Those who integrate the CRA requirements in a structured manner into development, the supply chain, and existing compliance processes lay the foundation for timely implementation.
This guide helps companies understand the Cyber Resilience Act and implement the necessary steps. It provides an initial overview of the company’s role, affected products, and required measures. Free and no personal information required!
This guide helps companies understand the Cyber Resilience Act and implement the necessary steps. It provides an initial overview of the company’s role, affected products, and required measures. Free and no personal information required!
The CRA is an EU regulation that establishes mandatory cybersecurity requirements for products with digital components.
The CRA has been in effect since the end of 2024. Reporting requirements take effect on September 11, 2026, and the full product requirements take effect on December 11, 2027.
This particularly affects manufacturers, importers, distributors, and retailers of digital products.
In general, the CRA covers hardware and software with digital elements that are newly made available on the EU market or that have undergone substantial changes.
Yes. Manufacturers are also responsible for integrated components such as software libraries, modules, or open-source components and must adequately assess their security risks.
Manufacturers must provide security updates during the intended support period and communicate this transparently to users. According to the guidelines, the expected product lifespan generally applies, but it must be at least five years.
Yes. The CRA requires the creation of an SBOM as a basis for vulnerability management, incident response, and market surveillance; however, it does not have to be published.
Depending on the violation, fines of up to 15 million euros or 2.5 percent of revenue may be imposed.
Companies should first determine whether their products fall under the CRA, identify the relevant risk classes, and define responsibilities. They should then review existing development, update, vulnerability, and reporting processes for CRA compliance and systematically prepare technical documentation, SBOMs, and supplier requirements.
Our CRA Practical Guide will help you with the next steps.
Sandra von König answers your personal questions, provides orientation and gives you a clear overview of the possibilities and added value.
Sandra von König
Your contact person
Sandra von König will answer your personal questions, provide guidance, and give you a clear overview of the options and added value.
Your contact person
Sandra von König
Laden Sie sich jetzt kostenfrei das E-Paper Potenzialanalyse: Daten & KI herunter und machen Sie den 5-Minuten-Check:
✔️ 10 Fragen zur Einordnung des digitalen Reifegrads
✔️ individuelle Erfolgschancen und Ableitungen für Ihr Unternehmen
✔️ konkrete, priorisierte Maßnahmen je Reifegradstufe
Klingt spannend? Mehr erfahren.
