What is the Cyber Resilience Act?
Regulation (EU) 2024/2847 establishes the first EU-wide mandatory horizontal cybersecurity requirements for all products with digital elements.
Who is covered?
Economic operators in the EU single market: manufacturers of connected hardware and software, authorised representatives, importers, and distributors (Articles 13–19). Pure non-commercial open-source software developed outside commercial activity is excluded; open-source software stewards are subject to Article 24. Manufacturers integrating open-source components remain responsible for the cybersecurity of the finished product.
What does it require?
Security by design and default (Art. 13 & Annex I Part I), attack surface reduction, vulnerability handling, and a machine-readable SBOM covering at least top-level dependencies (Annex I Part II point 1). Support period determination under Art. 13(8), user information under Art. 13(19) & Annex II, and free security updates under Annex I Part II point 8.
Reporting Obligations Active
Mandatory reporting under Article 14 applies from 11 September 2026: actively exploited vulnerabilities and severe security incidents must be reported within 24 hours (early warning) and 72 hours to competent CSIRTs and ENISA.
CE Marking & Conformity
Prior to market placement (mandatory from 11 December 2027), a conformity assessment pursuant to Art. 32 & Annex VIII must be completed: standard products via internal production control (Module A); important products (Art. 7 & Annex III Part I / II) via Module A (if harmonised standards fully applied) or notified body; critical products (Art. 8 & Annex IV) via third-party assessment or European cybersecurity certificate. EU Declaration of Conformity under Art. 28 & Annex V/VI and technical documentation under Art. 31 & Annex VII.
What Penalties Apply for Violations?
Non-compliance risks substantial regulatory sanctions: sales bans, product recalls, and fines of up to €15 million or 2.5% of worldwide annual turnover (Art. 64).
How it works
Answer
Eight short questions with predefined answers — no drafting required.
Review
Overview of all responses with immediate option to revise.
Result & Consultation
Instant readiness report in your browser (stored locally) and optional expert consultation.
Roadmap & Compliance
Initial classification, statutory deadlines, and actionable compliance roadmap.
What You Gain with CRASteps
Initial classification
Signals on potential CRA product classification, computed deterministically from your inputs.
Open points
Clearly stated where answers are missing or specialist review is needed — never quietly omitted.
Next steps
Up to three concrete recommendations justified by your actual answers.
Example result
Example — Demonstration data
Scope: EU · Form version 1 · Evaluated on 11/09/2026
Identified Security Status
- Automated generation and maintenance of SBOM (CycloneDX / SPDX) — Action required
Recommended next steps
Mandatory for security verification and third-party dependencies across the product lifecycle.
Mandatory early warning within 24 hours of actively exploited vulnerabilities under Art. 14.
Required prior to placing products on the EU internal market.
Initial assessment based on your inputs — no certificate, no exhaustive audit.
Methodology and limits
Our preparation framework aligns strictly with the final provisions of Regulation (EU) 2024/2847, European Commission guidelines, and ENISA publications. We support developers and manufacturers in early compliance readiness.
Applicable across the European Economic Area (EEA).
European Cybersecurity Framework
The Cyber Resilience Act is a cornerstone of the EU cybersecurity strategy, bridging the gap between organizational obligations and concrete product security across the digital single market.
Frequently Asked Questions about the CRA
When does the Cyber Resilience Act take effect?
Regulation (EU) 2024/2847 was published on 20 November 2024 and entered into force on 10 December 2024. Notified body provisions (Chapter IV) apply from 11 June 2026. Article 14 reporting obligations for actively exploited vulnerabilities apply from 11 September 2026. General product requirements and CE marking become mandatory on 11 December 2027.
What deadlines must manufacturers observe now?
From 11 September 2026, manufacturers must report actively exploited vulnerabilities to CSIRTs and ENISA within 24h and 72h (Art. 14). By 11 December 2027, all essential cybersecurity requirements (Art. 13 & Annex I), support period determinations (Art. 13(8)), technical documentation (Art. 31 & Annex VII), and conformity assessments (Art. 32 & Annex VIII) must be fully implemented.
Does the CRA apply to open-source software?
Free and open-source software developed or supplied outside commercial activity is outside the scope of the CRA. Open-source software stewards are subject to a tailored regime under Article 24. When a commercial manufacturer integrates open-source components, the manufacturer must ensure cybersecurity and document the SBOM; commercial integration does not make the upstream open-source developer a manufacturer.
What is a Software Bill of Materials (SBOM)?
A Software Bill of Materials (SBOM) is a machine-readable inventory of software components and dependencies. The statutory minimum requirement under Annex I Part II point (1) mandates covering at least top-level dependencies. Full transitive dependency tracking is recommended as industry technical best practice.
How does the CRA relate to the NIS2 Directive?
NIS2 regulates the cybersecurity governance and operational resilience of organisations and infrastructure operators. The CRA regulates the cybersecurity of products placed on the market. NIS2 entities will increasingly require suppliers to provide CRA-compliant products.
Dedicated Implementation Path & Conformity Audit
Verify your products with digital elements for CRA compliance. Clarify classification, SBOM requirements, and technical documentation with SKOPION Intelligence auditors.
Your data is processed confidentially in accordance with our Privacy Policy.