CRA compliance: find out for free how far it reaches your product

Which products does the Cyber Resilience Act cover?

The Cyber Resilience Act (CRA) is EU Regulation 2024/2847 on the cybersecurity of products with digital elements: from 11 December 2027 they may only be placed on the EU market if they meet Annex I and carry the CE marking. It covers every such product you sell in the EU that connects to a device or a network (Art. 2).

It does not cover medical devices, vehicles, aviation and marine equipment, which have their own rules, or pure SaaS with nothing at the customer; NIS2 covers cloud services of medium and large providers.

• firmware and embedded software
• apps, desktop and on-premise software
• connected devices and components sold separately
• a cloud part you develop yourself, if the product cannot perform one of its functions without it

What does Annex I require in practice?

Annex I has two parts: security properties of the product and processes for handling vulnerabilities. In engineering terms:

• no known exploitable vulnerabilities when placed on the market
• secure default configuration and a reset to factory state
• security updates, automatic where possible and separate from feature updates
• access control, encryption and integrity protection for data, commands and configuration
• logging of security-relevant access and a minimal attack surface
• a software bill of materials (SBOM) in a machine-readable format
• a coordinated vulnerability disclosure policy and a contact address for reports

Which conformity assessment do I need?

It depends on the product class. The core function decides, not the components inside: a machine with an operating system is not an “operating system” (Art. 7(1)).

• default product, which is most: the manufacturer assesses itself (module A) and affixes the CE marking
• important class I (Annex III), such as operating systems and routers: self-assessment only when harmonised standards or certification are fully applied, otherwise a notified body
• important class II (Annex III), such as firewalls and hypervisors: always a notified body or European certification
• critical (Annex IV), such as smartcards: European certification where the Commission requires it, otherwise as class II

Do products I already sell have to change?

It depends on whether you sell hardware or standalone software.

• hardware: every unit placed on the market from 11 Dec 2027 must comply, even if its type is older
• a redesign is not needed if the risk assessment shows existing measures suffice (Commission guidance)
• the conformity assessment, EU declaration of conformity and CE marking are always required
• software: a version offered before 11 Dec 2027 falls under the CRA only once substantially modified (Art. 69(2))
• reporting of actively exploited vulnerabilities already applies to all products on the market