// REGULATION (EU) 2024/2847 · CYBER RESILIENCE ACT
Your product has digital elements. Then the CRA applies to you.
Since 11 September 2026 manufacturers must report actively exploited vulnerabilities within 24 hours. From 11 December 2027 no product reaches the EU market without CRA conformity. We help you get there with analysis, working processes and solid evidence.
The timeline
As of October 2026- 10 Dec 2024
Entered into force
The regulation applies directly, with no national transposition act.
- 11 Sep 2026
Reporting obligations apply
Art. 14: actively exploited vulnerabilities and severe incidents via the ENISA platform.
- 11 Dec 2027
Full application
All product requirements, conformity assessment, CE marking.
What has applied since September and is often missed
The Article 14 reporting duty is not a future problem, it is running. If you place a product with digital elements on the EU market and learn of an actively exploited vulnerability, you have 24 hours for the early warning. Reports go through the ENISA Single Reporting Platform, operational since 11 September 2026; the recipient is the relevant national CSIRT, with ENISA informed in parallel.
24 hours
Early warning from becoming aware
72 hours
Full notification
14 days
Final report once corrective measures are available
The catch: a 24-hour deadline cannot be improvised. It needs a defined intake point, named owners including deputies, a decision tree for "reportable or not" and pre-drafted report texts. Build it when the case occurs and you will miss the deadline.
Does this even apply to us?
The CRA covers "products with digital elements" placed on the EU market, hardware and software alike. That affects far more companies than many assume: besides software firms, it covers the machine builder with a connected controller, the maker of a device with a companion app and the vendor of a desktop application.
Covered if…
- You develop software that you sell or license
- Your device has a network, Bluetooth or USB interface
- Your product comes with an app or a cloud service
- You import or distribute such products in the EU
- You integrate third-party components into your own product
Outside the scope
- Medical devices, vehicles and aviation, which have their own regimes
- Pure services without a product
- Non-commercial open source (stewards have their own, lighter duties from Dec 2027)
This boundary drives effort and schedule, and for composite products it is rarely obvious. That is why we clarify it first.
Four classes, four routes to conformity
Default
The normal case. Internal control by the manufacturer.
The large majority of products
Important · Class I
Self-assessment only via harmonised standards; otherwise a notified body is involved.
Operating systems, browsers, password managers, VPNs, routers, identity management
Important · Class II
A notified body is always involved. Internal control is excluded.
Firewalls, IDS/IPS, hypervisors, container runtimes
Critical
European certification scheme at assurance level "substantial".
Hardware security modules, smart cards, smart meter gateways
Where most plans break
Self-assessment via harmonised standards requires harmonised standards. They do not exist yet: as of August 2026 no CRA standard had been ratified as an EN or published in the Official Journal. The presumption of conformity under Art. 27 is therefore unavailable for every product category.
Waiting for the standards costs time you do not have. Conformity can be shown without a harmonised standard, through clean technical documentation that derives compliance with Annex I directly. We build that documentation with you and structure it so you can switch to the standards later without starting over.
What the CRA asks of you
Secure by default
Products must ship without known exploitable vulnerabilities, with a secure default configuration and a minimal attack surface. The requirements are in Annex I.
Risk assessment
A documented cybersecurity risk assessment belongs in product design and in the technical documentation.
SBOM & components
A software bill of materials covering at least top-level dependencies. Plus a process that finds vulnerabilities in third-party components before your customer does.
Vulnerability handling
Intake channel, remediation and free security updates, kept separate from feature updates. Plus the Article 14 reporting path.
Support period
At least five years of security updates, adjusted where the expected product lifetime is shorter. This commitment affects costing and belongs in product management, not in legal.
Evidence
Technical documentation, EU declaration of conformity, CE marking. Retained for at least ten years.
The penalty framework
up to €15m or 2.5%
Essential requirements under Annex I and core manufacturer obligations
up to €10m or 2%
Other obligations: conformity assessment, documentation, CE, importer and distributor duties
up to €5m or 1%
Incorrect or incomplete information to authorities and notified bodies
Whichever is higher, the fixed amount or the share of worldwide annual turnover. In practice, a mid-sized company is more likely to feel the CRA through large customers' procurement than through a fine: from 2027, buyers will want to see the declaration of conformity before they order.
How we help
Five building blocks. Bookable separately, designed to build on each other.
Scoping and classification
Which of your products fall under the CRA, which class applies, and what conformity route follows? The result is a defensible classification per product with reasoning. Every further step and your schedule build on it.
Product list with classification · Reasoning per product · Schedule to Dec 2027
Article 14 reporting process
The most urgent block, because the duty is already running. We define the intake point, roles and deputies, the decision tree for reportability and the connection to the ENISA platform. We also prepare the report texts for 24h, 72h and the final report.
Reporting process · Roles & escalation · Decision tree · Templates · Dry run
Annex I gap analysis
Your product and your development process assessed against the essential requirements. Every gap is scored, prioritised and paired with a concrete measure. We work as systematically as in an ISO 27001 audit.
Gap report per requirement · Prioritised actions · Effort estimate
Vulnerability management & SBOM
From a bill of materials to a running process: SBOM generation in the build, matching against vulnerability databases, triage, patch path and the committed support period. Including a coordinated vulnerability disclosure policy for external reports.
SBOM in the build · VM process · CVD policy · Support and update policy
Technical documentation & conformity
The evidence chain that counts in the end: risk assessment, Annex I evidence, test records, EU declaration of conformity. Structured so it can move to harmonised standards once they arrive.
Technical documentation · Declaration of conformity · Ten-year retention
Prefer to do it yourself? The CRA Readiness Kit
Nine editable tools for your team: classification tool, Annex I gap assessment, Article 14 reporting playbook, SBOM and CVD policy, templates for technical documentation and the declaration of conformity, roadmap to December 2027. German and English, €349, instant download.
A natural companion: product security testing
The claim "no known exploitable vulnerabilities" needs evidence. Through our network of certified penetration testers we test your product's firmware, web interface, API or mobile app and deliver the test record for the technical documentation.
Authorities in the DACH region
Germany
The BSI is designated as both market surveillance and notifying authority; the CRA implementation act provides the national frame. The BSI can test products on a sample or targeted basis and impose sanctions.
Austria
The notifying authority sits within the Federal Chancellery (national cybersecurity certification authority). The market surveillance authority has not been finally designated yet. The obligations apply anyway, because the CRA is a directly applicable regulation.
Switzerland
Not an EU member and therefore not directly bound. Anyone shipping into the EU is, however, fully covered as a third-country manufacturer and additionally needs an authorised representative in the Union.
Frequently asked
The first step is small
It starts with one question: which of your products fall under the CRA, and in which class? Tell us briefly what you make. We will come back with a first assessment and a fixed price for the analysis.
Request CRA scopingThis page reflects the status as of October 2026 and is provided for information. It is not legal advice. The classification of your products and the resulting obligations depend on the individual case.