The Cyber Resilience Act has been on the books since 2024, but its requirements apply in different phases, and a key implementation deadline, related to exploited and severe incidents reporting, is arriving in September 2026. Full compliance is expected by the end of 2027. For anyone who makes or sells connected hardware and software products, now is a good moment to look at what it means.
The CRA sets cybersecurity requirements for products with digital elements sold on the EU market, and those requirements run across the product lifecycle. Anything that connects to a device or a network most likely falls within scope, even when the manufacturer sits outside the EU.
The CRA sets cybersecurity requirements for products with digital elements sold on the EU market, and those requirements run across the product lifecycle. Anything that connects to a device or a network most likely falls within scope, even when the manufacturer sits outside the EU.
What does the CRA require?
At its core, the CRA is about looking after connected products properly, throughout their lifecycle. The main obligations:
- Security flaws fixed for at least five years, with updates kept available for ten
- A support period stated clearly, on the product or an easily found webpage, so customers know how long protection lasts
- Actively exploited vulnerabilities flagged to the authorities within 24 hours, followed by a fuller report within 72 hours
- A conformity route that fits the product, with stricter checks for those classed as important or critical
Non-compliance can cost up to €15 million, or 2.5% of turnover, whichever is higher.
