What Is the Cyber Resilience Act?
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is the EU law that sets minimum cybersecurity requirements for connected hardware and software sold on the European market. It entered into force on 10 December 2024 and takes effect in stages, in full from 11 December 2027.
The logic is familiar to anyone who works with CE marking. A product has to meet essential requirements, the manufacturer assesses conformity, prepares technical documentation, signs an EU declaration of conformity and affixes the CE mark. What is new is that the duty does not end at delivery. Manufacturers have to handle vulnerabilities and provide security updates for as long as the product is supported, and they have to report serious security events to the authorities.
Which Products Does the CRA Cover?
The CRA applies to products with digital elements: software or hardware, including the remote data processing that belongs to it, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. In industry, that can mean controllers, HMI panels, gateways, drives with network interfaces, firmware and engineering software, including components sold on their own.
Some products are excluded because sector rules already cover them:
- Medical devices and in vitro diagnostic devices
- Motor vehicles under EU type-approval
- Certified civil aviation products
- Marine equipment
- Products developed or modified exclusively for national security or defence
Free and open-source software that is not supplied in the course of a commercial activity is also outside the regulation. Machinery is not excluded, so any machine placed on the market with a data connection needs to be checked.
Products placed on the market before 11 December 2027 only come under the main requirements if they are substantially modified after that date. The reporting obligations apply to them regardless.
The CRA Deadlines
- 10 December 2024: The regulation entered into force.
- 11 June 2026: The rules for notifying conformity assessment bodies started to apply.
- 11 September 2026: The reporting obligations started to apply.
- 11 December 2027: All remaining obligations apply, including the essential requirements, the conformity assessment and CE marking.
What Manufacturers Have to Do
- Cybersecurity risk assessment: Assess the product’s risks across planning, design, development, production, delivery and maintenance. Document the assessment, keep it up to date and use it to decide how the essential requirements apply to your product.
- Security by design: Place the product on the market without known exploitable vulnerabilities, with a secure default configuration, protection against unauthorised access, protected data, a limited attack surface and the ability to receive security updates.
- Vulnerability handling: Identify and document the components and vulnerabilities of the product, including a software bill of materials (SBOM), publish a policy for coordinated vulnerability disclosure and distribute security updates without delay.
- Due diligence: Check that third-party components, including open-source software, do not compromise the security of the product.
- Support period: Set a support period of at least five years, unless the product is expected to be in use for less time, and state its end date at the time of purchase.
- Documentation and CE marking: Prepare the technical documentation, complete the conformity assessment, draw up the EU declaration of conformity and affix the CE mark. The documentation has to be kept for at least ten years or for the support period, whichever is longer.
Reporting Duties: 24 Hours, 72 Hours, 14 Days
Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents affecting the security of their products. Reports go through the single reporting platform run by ENISA, the EU cybersecurity agency.
- Early warning: within 24 hours of becoming aware.
- Notification: within 72 hours, with more detail and the measures taken.
- Final report: no later than 14 days after a fix or mitigation is available for an exploited vulnerability, and within one month of the notification for a severe incident.
These deadlines leave no time to organise anything once an incident has happened. Someone has to own the process, and the company has to be able to tell quickly which products and software versions are affected.
Self-Assessment or Notified Body?
The conformity assessment route depends on the product category:
- Default category: The manufacturer can assess conformity itself.
- Important products, class I: Self-assessment is only possible if harmonised standards, common specifications or a European cybersecurity certification are applied. Otherwise a notified body is involved.
- Important products, class II: A third-party assessment is required.
- Critical products: These follow the strictest route, which can include a mandatory European cybersecurity certificate.
Infringing the essential requirements or the manufacturer obligations can cost up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher.
The CRA and the EU Machinery Regulation
A connected machine can fall under both the CRA and the EU Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027. According to the European Commission services’ FAQ on the CRA, such products have to meet both sets of requirements. Meeting the CRA can make it easier to comply with the machinery requirements on protection against corruption and on the safety and reliability of control systems (Annex III, sections 1.1.9 and 1.2.1). It does not do so automatically: the manufacturer has to demonstrate the connection.
The two laws also ask different questions. The CRA looks at the cybersecurity of the product. The Machinery Regulation asks whether corruption could lead to a hazardous situation. The standard being prepared for that second question is EN 50742, and IEC 62443 offers a recognised method for the security work behind both.
In practice, it pays to keep one system model, one list of threats and one set of measures, and to trace each requirement to the regulation it serves. EnCo ASE Threat Assessment holds the system model, threats, protection requirements and evidence for EN 50742 in one place. That gives you a solid basis for the CRA risk assessment. Vulnerability handling and the reporting process remain organisational tasks that have to be set up separately.
How to Start
- List your products with a direct or indirect data connection and check which category each one falls into.
- Put the reporting process in place now: who decides, who reports and how you find the affected versions.
- Start an inventory of your software components, including third-party and open-source software.
- Define support periods and check that you can deliver updates for that long.
- If you build machinery, combine the CRA risk assessment with your EN 50742 threat assessment.
- Schedule a free consultation and discuss the threat assessment using one of your own machines as the example.
Conclusion
The Cyber Resilience Act makes cybersecurity a condition for CE marking of connected products and extends the manufacturer’s responsibility across the whole support period. The reporting duties already apply, and the remaining obligations follow on 11 December 2027. Manufacturers who build one shared picture of their product’s risks now will not have to do the work twice when the machinery requirements and the CRA take full effect.
