The full Cyber Resilience Act can be found in 24 different languages on the EUR-Lex website. It is the online database of European Union Law and related documents. The full English document is around 81 pages. Being a legal text it is quite long and can be quite dense. On this page we provide a summary of the key points in the text so you don’t have the read the full text.

In case you do want to read the full text you can find it here.

For specific guidance on CRA refer to our guidance articles.

Summary

The Cyber Resilience Act (CRA), officially Regulation (EU) 2024/2847, was adopted on October 23, 2024, to establish a unified European framework for the cybersecurity of products with digital elements (PDEs). It addresses the widespread vulnerabilities in hardware and software and the inconsistent provision of security updates, aiming to ensure that products are secure throughout their entire lifecycle.

1. Objectives and Legal Framework

The primary goal of the CRA is to improve the functioning of the internal market by laying down a uniform legal framework for essential cybersecurity requirements. It seeks to:

• Ensure that hardware and software products are placed on the market with fewer vulnerabilities.
• Mandate that manufacturers take security seriously throughout a product’s lifecycle.
• Improve transparency for users regarding the support periods and security properties of the products they choose.

The Regulation is based on Article 114 of the TFEU and supplements existing legislation like the Cybersecurity Act and the NIS 2 Directive, which do not directly cover mandatory security requirements for products.

2. Scope and Definitions

Scope of Application

The CRA applies to all products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. This includes:

• Hardware products, such as connected devices and their physical components.
• Software products, including operating systems and applications.
• Remote data processing solutions, provided they are developed by or for the manufacturer and are necessary for the product’s function.

Specific Exclusions

Certain products already covered by sector-specific regulations are excluded to avoid duplication:

• Medical devices and in vitro diagnostic medical devices.
• Motor vehicles and their components.
• Civil aviation equipment and parts.
• Products developed exclusively for national security or defense.
• Marine equipment.
• Spare parts that are identical to original components and manufactured to the same specifications.

3. Categories of Products

The CRA distinguishes between products based on their cybersecurity risk and functionality.

4. Essential Cybersecurity Requirements

Annex I of the Regulation sets out two categories of essential requirements:

Part I: Security Properties

Manufacturers must design, develop, and produce PDEs to ensure an appropriate level of cybersecurity, including:

• No known exploitable vulnerabilities upon being placed on the market.
• Secure by default configuration, with the ability to reset to the original state.
• Protection from unauthorized access through authentication and identity management.
• Data protection (confidentiality and integrity) using encryption and other state-of-the-art mechanisms.
• Data minimisation, processing only what is necessary for the intended purpose.
• Attack surface limitation and the use of exploitation mitigation techniques.

Part II: Vulnerability Handling

Manufacturers are required to:

• Identify and document vulnerabilities and components, including drawing up a Software Bill of Materials (SBOM).
• Address and remediate vulnerabilities without delay via security updates.
• Provide security updates separately from functionality updates whenever feasible.
• Enforce a policy on coordinated vulnerability disclosure.
• Publicly disclose information about fixed vulnerabilities.

5. Obligations of Economic Operators

The CRA imposes strict duties on various actors in the supply chain.

Manufacturers

• Risk Assessment: Must conduct and document a cybersecurity risk assessment to identify relevant risks and applicable requirements.
• Support Period: Manufacturers must determine a support period (minimum of five years, unless the product’s lifetime is shorter) during which they must handle vulnerabilities.
• Technical Documentation: Must draw up technical documentation (Annex VII) before placing the product on the market.
• CE Marking: Must affix the CE marking and draw up an EU declaration of conformity.
• Reporting: Must notify actively exploited vulnerabilities and severe incidents simultaneously to the designated CSIRT and ENISA via a single reporting platform.

Importers and Distributors

• Importers must ensure the manufacturer has carried out the proper conformity assessment and drawn up technical documentation . They must not place a product on the market if they believe it is non-compliant.
• Distributors must verify the presence of the CE marking and that the manufacturer and importer have fulfilled their identification and documentation duties .

6. Provisions for Free and Open-Source Software (FOSS)

The CRA recognizes the unique nature of FOSS.

• Exclusion for Non-Commercial Activity: FOSS developed or supplied outside of a commercial activity (e.g., by not-for-profit organizations or individuals not under a manufacturer’s responsibility) is generally out of scope.
• Open-Source Software Stewards: Legal persons who provide sustained support for FOSS intended for commercial activities are subject to a “light-touch” regime. They must put in place a cybersecurity policy but are not permitted to affix CE markings.
• Attestation Programmes: The Commission may establish voluntary security attestation programmes to help manufacturers perform due diligence on FOSS components.

7. Conformity Assessment Procedures

Conformity must be demonstrated through specific modules:

• Internal Control (Module A): For default products and Class I important products that apply harmonized standards or common specifications.
• Third-Party Assessment (Modules B+C or Module H): Mandatory for Class II important products, critical products, and Class I products that do not use harmonized standards .
• European Cybersecurity Certification: The Commission can mandate certification under the Cybersecurity Act for critical products to demonstrate conformity.

8. Market Surveillance and Enforcement

Authorities and Tools

Each Member State must designate market surveillance authorities to ensure implementation. These authorities have the power to:

• Request access to documentation and data.
• Require corrective actions, withdrawals, or recalls for non-compliant products.
• Conduct sweeps (coordinated control actions) across categories of products.

Penalties

Member States must establish rules on penalties that are effective, proportionate, and dissuasive. Maximum administrative fines are significant:

• Up to €15,000,000 or 2.5% of total worldwide annual turnover for non-compliance with essential requirements or manufacturer obligations.
• Up to €10,000,000 or 2% for other non-compliance (e.g., documentation, CE marking).
• Up to €5,000,000 or 1% for supplying incorrect or misleading information.
• Fines are adapted for SMEs and microenterprises, and do not apply to open-source software stewards.

9. Support for SMEs and Microenterprises

To minimize the burden on smaller entities, the CRA includes:

• Guidance: The Commission must provide targeted guidance for SMEs.
• Simplified Documentation: A simplified technical documentation form will be available for micro and small enterprises.
• Financial Support: Member States and the Commission are encouraged to offer financial assistance, training, and testing activities.
• Regulatory Sandboxes: Controlled environments for testing innovative products before they are placed on the market.

10. Timeline and Application

The Regulation entered into force on the 20th day after its publication.

• General Application: December 11, 2027.
• Reporting Obligations (Article 14): September 11, 2026.
• Notification of Conformity Assessment Bodies: June 11, 2026.

Legacy Products: Products placed on the market before December 11, 2027, are generally exempt unless they undergo a substantial modification after that date.

Are we ready for CRA?

With the CRA Framework in SAMMY, you can assess CRA compliance for your different products. The questions and quality criteria give you a complete checklist of everything that is required by CRA. SAMMY also makes it easy to compare products groups, manage compliance roadmaps and collaborate with team members.

Find out more about the SAMMY tool for CRA assessments. 

Not sure if your product is in scope?

Use the CRA Scope Assessment tool to find out in 3 minutes.