Regulation (EU) 2024/2847, the Cyber Resilience Act, sets EU-wide cybersecurity requirements for hardware and software products with digital elements. This pillar covers product classification, the Annex I essential requirements, vulnerability handling and reporting, operator obligations and conformity assessment.
Which products the regulation covers and excludes, and how a product's core functionality places it in the default, important (Annex III class I or II) or critical (Annex IV) category, which sets the conformity assessment route.
The product-level requirements every product with digital elements must meet when placed on the market, applied on the basis of the manufacturer's cybersecurity risk assessment: one page for the risk assessment and one for each of points (2)(a) to (m).
The eight Annex I Part II process requirements manufacturers must meet for the whole support period, and the Article 14 duty to notify actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, in force since 11 September 2026.
What the regulation requires of manufacturers, importers, distributors and anyone who substantially modifies a product, including the support period, and the lighter regime for open-source software stewards.
How manufacturers demonstrate conformity (harmonized standards, technical documentation, conformity assessment modules, EU declaration and CE marking) and how national market surveillance authorities check products and enforce the regulation.
Operational guides for the Article 14 reporting duty that has applied since 11 September 2026: the ENISA platform, the 24-hour early warning, choosing the CSIRT, third-party components and informing users.
Guides to the CRA's supply chain duties: component due diligence, SBOM tooling, vulnerability management across dependencies and third-party cloud services built into a product.
Guides to how the CRA applies to specific products and models: SaaS and cloud backends, mobile apps, IoT devices, industrial products, enterprise software, security software in classes I and II, open-core companies and individual maintainers.
Guides for buying outside help with the CRA: penetration testing, coordinated vulnerability disclosure and PSIRT setup, harmonized standards, notified bodies and support for SMEs.
Questions organizations ask when the Cyber Resilience Act applies to their products: the timeline, whether it applies, what compliance costs, penalties and enforcement, the conformity assessment route and notified bodies, and how open source is treated.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.