CRA EU

The CRA EU is Regulation (EU) 2024/2847 � the Cyber Resilience Act. It establishes the first mandatory cybersecurity requirements for products with digital elements across the entire EU single market. As an EU regulation, the CRA applies directly in all member states without requiring national transposition. The regulation entered into force on

10 December

2024 and governs security requirements for hardware and software throughout the entire product lifecycle.

The CRA EU regulation follows a phased timeline: entry into force on

10 December 2024, reporting obligations for actively exploited vulnerabilities from

11 September 2026, and full applicability of all main obligations from

11 December 2027. Manufacturers must observe the 21-month transition period for reporting obligations and the 36-month period for all remaining requirements.

The EU CRA applies to three categories of economic operators: manufacturers of products with digital elements (e.g., IoT devices, software applications), importers who bring such products into the EU, and distributors who make them available on the EU market. Open-source software is generally in scope, though the regulation provides an exemption for non-commercial open-source development and introduces the new role of open source steward.

The CRA EU regulation defines three product categories: default products (manufacturer self-assessment sufficient), important products Class I and II (e.g., password managers, firewalls � third-party assessment may be required), and critical products (e.g., smartcard systems, hardware security modules � mandatory assessment by a Notified Body). The classification determines the required conformity assessment procedure and the effort needed for CE marking.

The CRA EU regulation requires manufacturers to create a Software Bill of Materials (SBOM). The SBOM documents all software components of a product, including third-party libraries and open-source components. It ensures transparency across the software supply chain and enables rapid identification of affected products when new vulnerabilities are discovered. The SBOM must be machine-readable and kept up to date throughout the product support period.

Non-compliance with the CRA EU regulation can result in fines of up to EUR

15 million or 2.5% of total worldwide annual turnover, whichever is higher. National market surveillance authorities monitor compliance and can order non-conforming products to be withdrawn from the EU market. Additionally, CE marking can be revoked, effectively blocking market access across the entire EU single market.

ADVISORI guides manufacturers, importers, and distributors through complete CRA EU compliance: from product classification and gap analysis to SBOM creation and CE marking. Our consultants combine regulatory expertise with technical understanding of security-by-design, vulnerability management, and conformity assessment procedures � tailored to your product category and EU market requirements.