law
Cyber Resilience Act
A regulation on the security of products that contain software: connected hardware and software sold in the EU. Reporting of exploited vulnerabilities has applied since 11 September 2026. The main duties start on 11 December 2027.
at a glance
- what it is
- Regulation (EU) 2024/2847, directly applicable. A product law: it sets security requirements for products with digital elements, and enforcement works like other CE-marked products.
- who it covers
- Manufacturers, importers and distributors of hardware and software made available on the EU market. Open-source software stewards have lighter duties of their own.
- the size line
- None for the duties. Micro and small enterprises get relief on two points only: one reporting deadline and the fine rules for it.
- fine ceilings
- €15 million or 2.5% of worldwide turnover for the security requirements and the manufacturer's core and reporting duties. €10 million or 2% for other listed duties. €5 million or 1% for misleading information to authorities.
- dates
- 11 September 2026 reporting. 11 December 2027 everything else. 11 June 2026 for the rules on notified bodies.
- status
- In force since 10 December 2024. Reporting applies now.
basis CRA art. 2(1), 3(13), 14(2), 64(2), 64(3), 64(4), 64(10), 71(2)
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my rulesthree dates in the CRA
- 111 June 2026 the rules on notified bodies for conformity assessment apply
- 211 September 2026 reporting of actively exploited vulnerabilities and severe incidents applies
- 311 December 2027 the rest of the regulation applies
basis CRA Art. 71(2)
two kinds of report, one clock that starts when you become aware
basis CRA Art. 14(2), 14(4)
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- know your role and your product
Find out which of your products are covered, what role you play for each and which band each falls in.
- build security into the product
Turn the product requirements into things the team designs, builds and tests.
- handle vulnerabilities and report
Be able to receive a vulnerability report, fix the flaw and send the 24 hour, 72 hour and final reports in time.
- set the support period and build the technical file
Decide how long you support each product, keep the proof in a technical file and complete the conformity assessment for the product's band.
- ask your suppliers and answer your buyers
Check what you receive from the chain, ask your own suppliers for what the law makes you need and be ready to answer your customers.
the dates
What applies when. The reference sits under each date.
- 11 June 2026the rules on notified bodies for conformity assessment applyCRA Art. 71(2)applies now
- 11 September 2026reporting of actively exploited vulnerabilities and severe incidents appliesCRA Art. 71(2)applies now
- 11 December 2027the rest of the Cyber Resilience Act appliesCRA Art. 71(2)coming
the fine ceilings
The ceilings each text sets. The reference sits under each.
- security requirements and core dutiesup to €15 million or 2.5% of worldwide annual turnover, whichever is higherCRA Art. 64(2)
Covers the security requirements and the manufacturer's core and reporting duties.
- other listed dutiesup to €10 million or 2% of worldwide annual turnover, whichever is higherCRA Art. 64(3)
The other duties the article lists.
- misleading informationup to €5 million or 1% of worldwide annual turnover, whichever is higherCRA Art. 64(4)
For misleading information given to authorities.
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
- CRA Annex I part I
No known exploitable vulnerabilities at release, secure defaults, access control, protection of data, limited attack surface and logging.
- CRA Annex I part II
Manufacturers: security updates without delay, regular security testing and public information about fixed vulnerabilities.
- CRA Annex I Part II
A manufacturer keeps a record of the product's components in a software bill of materials, in a commonly used, machine-readable format that covers at least the top-level dependencies.
- CRA Art. 13(1)
Manufacturers: a product designed, developed and produced to meet the security requirements of annex I part I.
- CRA Art. 13(5)
Third-party components, including open-source ones, need due diligence.
- CRA Art. 14(1)
Manufacturers report an actively exploited vulnerability in their product: an early warning within 24 hours, a notification within 72 hours and a final report.
- also in the plan
the long read
The full explanation, section by section, with the sources.