CRA Cyber Resilience Act – Product Registration

CRA product registration is the formal process by which manufacturers demonstrate that their products with digital elements meet the cybersecurity requirements of the Cyber Resilience Act. All hardware and software products with digital elements placed on the EU market are affected, including operating systems, firmware, IoT devices, network equipment, and software components. Registration involves a conformity assessment, technical documentation, and CE marking.

The CRA follows a phased timeline: From

11 June 2026, conformity assessment bodies are authorised to evaluate products. From

11 September 2026, vulnerability and incident reporting obligations apply (early warning within

24 hours, notification within

72 hours). Full applicability of all CRA requirements including product registration and CE marking takes effect from

11 December 2027.

The EU Declaration of Conformity under CRA (Annex V) is a binding document in which the manufacturer declares that the product meets all essential cybersecurity requirements. It must include the product name, manufacturer details, applied harmonised standards, the conformity assessment procedure used, and the CE marking reference. This declaration must be retained for ten years and presented to market surveillance authorities upon request.

The CRA conformity assessment involves several steps: First, a risk assessment of the product. Second, implementation of essential cybersecurity requirements (security by design and security by default). Third, preparation of technical documentation per Annex VII. Fourth, completion of the conformity assessment procedure (Articles 24‑25), with critical products requiring third-party assessment. Fifth, the EU Declaration of Conformity and CE marking.

Technical documentation under CRA Annex VII includes: a general product description, a risk assessment identifying cybersecurity risks, a description of implemented security measures, a Software Bill of Materials (SBOM), conformity assessment test results, and the defined support period for security updates. This documentation must be prepared before market placement and retained for ten years.

CE marking under the CRA indicates that a product with digital elements meets all essential cybersecurity requirements. For software, the CE marking is placed in accompanying documentation or on the download platform. The manufacturer thereby declares that a conformity assessment has been completed, technical documentation exists, and the support period for security updates is defined. Only one CE marking is issued covering all applicable EU legislation.

From September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents. The deadlines are strict: early warning within

24 hours, full notification within

72 hours, and a final report no later than

14 days after a corrective measure is available. For severe incidents, the final report deadline is one month. Reports are submitted to ENISA and the relevant national authority.