Meet your EU CRA obligations before the December 2027 deadline

The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is an EU law that sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU. It requires secure design, cybersecurity risk assessment, vulnerability handling, security updates for a defined support period, reporting of actively exploited vulnerabilities and severe incidents, and a conformity assessment with CE marking before products are placed on the market.

Manufacturers, importers and distributors of products with digital elements made available on the EU market must comply, wherever they are based. That includes connected devices, software and components sold separately. Manufacturers carry the main obligations under Articles 13 and 14. Importers and distributors have their own duties under Articles 19 and 20, and take on manufacturer obligations if they sell under their own name or substantially modify a product. Open-source software stewards have lighter duties under Article 24.

The CRA entered into force on 10 December 2024 and most of its obligations apply from 11 December 2027. Two parts apply earlier: the rules on notifying conformity assessment bodies (Chapter IV) from 11 June 2026, and the manufacturer reporting obligations in Article 14 from 11 September 2026. Reporting of actively exploited vulnerabilities and severe incidents therefore already applies, including to products placed on the market before 2027.

Under Article 14, manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security to the designated coordinator CSIRT and ENISA through the single reporting platform. An early warning is due within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within 14 days after a fix is available for vulnerabilities, or within one month of the incident notification for severe incidents.

Breaching the Annex I essential cybersecurity requirements or the manufacturer obligations in Articles 13 and 14 can lead to fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher. Other listed obligations carry fines of up to EUR 10 million or 2%, and supplying incorrect or misleading information to authorities up to EUR 5 million or 1%. Market surveillance authorities can also require non-compliant products to be withdrawn or recalled.

You comply by building CRA requirements into your product lifecycle. Classify each product (default, important class I or II, or critical), carry out and document a cybersecurity risk assessment, meet the Annex I essential requirements, set up vulnerability handling and a support period of at least five years where expected use allows, prepare technical documentation, complete the right conformity assessment, issue an EU declaration of conformity, affix the CE marking and be ready to report within 24 hours.

The CRA regulates the security of products, while NIS2 regulates the cybersecurity of organisations providing essential and important services, and the GDPR protects personal data. They complement each other: CRA-compliant products help NIS2 entities manage supply chain risk. ISO 27001 is a voluntary management system standard, so certification does not prove CRA conformity, but its risk management, supplier and incident processes give manufacturers a strong foundation for CRA obligations.

Yes. The CRA is supported in OneClickComply today. Mapped controls let evidence you already collect for frameworks such as ISO 27001 count towards CRA obligations, and our in-house audit team can guide you through risk assessment, vulnerability handling and documentation. OneClickComply does not issue CE marking or carry out notified body assessments.