Get ready for the EU Cyber Resilience Act
ComplyCRA helps software companies, product teams, and security leaders understand what the CRA means in practice — and how to prepare with the right security, evidence, and implementation approach.
New to CRA? Start here.
Five steps to go from confusion to clarity. Follow this path to understand the Cyber Resilience Act and what it means for your organization.
Step 1
What is CRA?
Understand the regulation and why it matters for digital products.
Step 2
Does it apply to you?
Find out if your product or organization falls under CRA scope.
Step 3
What do you need to do?
Learn about the cybersecurity, vulnerability, and documentation requirements.
Step 4
How prepared are you?
Assess your current readiness and identify gaps.
Step 5
Where should you start?
Get a structured path from understanding to action.
The window to prepare is closing
CRA is EU law with real deadlines, real fines, and real engineering work required. The numbers make the urgency clear.
Legal obligation, not optional
The CRA is EU law. Non-compliant products risk market withdrawal, fines, and reputational damage. Understanding your obligations now gives you time to address gaps systematically.
Compliance requires real engineering work
Meeting CRA's essential requirements means secure-by-design practices, SBOM generation, vulnerability management processes, and formal conformity evidence. These changes can't be rushed.
Standards are still maturing
The EN 18045 and related harmonised standards are still being finalized. Organizations that start early can shape their approach while standards evolve — rather than scrambling to retrofit later.
Key dates & deadlines
Compliance is not optional and the deadline is fixed. Here is when each obligation begins and what it means for your organization.
CRA enters into force
The Cyber Resilience Act was officially published in the EU Official Journal. The regulatory clock started ticking for all software manufacturers placing products on the EU market.
Vulnerability reporting obligations begin
Manufacturers must begin reporting actively exploited vulnerabilities and severe incidents to ENISA within 24 hours of discovery. Processes and tooling must be in place before this date.
Full CRA compliance required
All CRA requirements fully apply. Products must meet cybersecurity, documentation, and vulnerability handling requirements — or face market withdrawal and fines of up to €15M.
Featured CRA resources
Guides, webinars, standards insights, and practical examples — everything you need to move from understanding to action.
Summary of the Cyber Resilience Act
A comprehensive overview of CRA scope, requirements, timelines, and what it means for digital product teams.
Understanding the Cyber Resilience Act
Expert-led walkthrough of CRA fundamentals, enforcement timeline, and practical compliance considerations.
CRA standards & the EN 18045 series
How the EN 18045 and related harmonised standards translate CRA legal requirements into concrete technical controls.
Preparing for CRA with SAMMY
A practical walkthrough showing how product teams use OWASP SAMM and SAMMY by Codific to structure CRA readiness.
CRA fines, penalties & enforcement
A clear breakdown of CRA's enforcement mechanisms, fine structures, and what market surveillance authorities can do.
CRA in practice: stories from the field
Real conversations with security engineers and compliance leads navigating CRA preparation in their organizations.
Learn from CRA experts
Watch and listen to deep-dive sessions on CRA implementation, security maturity, and practical compliance preparation.
Podcast
Understanding the Cyber Resilience Act: what software and product companies need to know
Deep dive
Cyber Resilience Act explained: a practical guide for software vendors
Podcast series
AppSec Science meets Compliance: a CRA deep-dive with Aram and Lara
Preparing for CRA with SAMMY
SAMMY is the free tool that helps software teams assess, manage, and evidence CRA compliance across their product portfolio. Built on OWASP SAMM by AppSec and legal experts — covering risk assessment, technical requirements, vulnerability management, and documentary obligations.
