The Cyber Resilience Act, or CRA, introduces new cybersecurity requirements for products with digital elements sold in the EU. This page gives clear answers to some of the most common questions about scope, deadlines, standards, preparation, and penalties.
What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act, or CRA, is an EU regulation that sets a baseline level of cybersecurity for products with a digital component sold in the EU. In practice, it focuses on three areas: cybersecurity requirements, vulnerability handling requirements, and communication requirements, as explained in this overview of the Cyber Resilience Act.
Why was the Cyber Resilience Act introduced?
The Cyber Resilience Act was introduced because too many digital products were being sold with weak cybersecurity, avoidable vulnerabilities, poor long term support, and too little transparency for users. It was meant to create one clearer EU baseline and make security a responsibility of the producer throughout the product lifecycle, as explained in this article on why the Cyber Resilience Act was introduced.
By when do companies need to comply with the Cyber Resilience Act?
Companies should treat the Cyber Resilience Act as a phased timeline, not a single deadline. The main compliance date is 11 December 2027, but some obligations start earlier, especially the reporting obligations from 11 September 2026, as explained in this article on when companies need to comply with the Cyber Resilience Act.
Who needs to comply with the Cyber Resilience Act?
The Cyber Resilience Act mainly applies to companies that place hardware or software products with digital elements on the EU market as part of a commercial activity. In most cases, that means manufacturers, importers, and distributors, although a retailer can also be treated as a manufacturer in some situations, as explained in this article on who needs to comply with the Cyber Resilience Act.
How do companies prepare for the Cyber Resilience Act?
Companies prepare for the Cyber Resilience Act by treating it as a product security effort, not just a legal exercise. A practical approach is to define the scope, assess the current security posture, set a target state, and then plan and implement the improvements needed to close the gaps, as explained in this article on how to prepare for the Cyber Resilience Act.
Does the Cyber Resilience Act vary by country?
No, the core legal requirements of the Cyber Resilience Act do not vary by country because it creates one common EU framework. However, the practical side of compliance can still differ between Member States, especially around enforcement, guidance, supervision, and reporting channels, as explained in this article on whether the Cyber Resilience Act varies by country.
What are the fines for non-compliance with the Cyber Resilience Act?
The fines under the Cyber Resilience Act can be significant. The highest tier is up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, with lower tiers of up to €10 million or 2% and €5 million or 1% depending on the type of infringement. The article also notes that non-compliance can lead to product restrictions, withdrawal, or recall, as explained in this article on CRA fines
What are the Cyber Resilience Act standards?
The Cyber Resilience Act standards are the technical standards that will help companies show that their products meet the CRA’s cybersecurity requirements. In practice, they give organizations a more concrete way to translate the regulation into product development, documentation, and conformity work, as explained in this article on Cyber Resilience Act standards.
Are we ready for CRA?
With the CRA Framework in SAMMY, you can assess CRA compliance for your different products. The questions and quality criteria give you a complete checklist of everything that is required by CRA. SAMMY also makes it easy to compare products groups, manage compliance roadmaps and collaborate with team members.
Find out more about the SAMMY tool for CRA assessments.