Questions organizations ask when the Cyber Resilience Act applies to their products: the timeline, whether it applies, what compliance costs, penalties and enforcement, the conformity assessment route and notified bodies, and how open source is treated.
Every date that matters for the Cyber Resilience Act, from entry into force in December 2024 through reporting obligations in September 2026 to full application in December 2027, plus the implementing and delegated acts, guidance and standards adopted or expected along the way.
A step-by-step way to decide whether the Cyber Resilience Act covers your products and in what role: products with digital elements, commercial activity, SaaS and remote data processing, sector exclusions, legacy products, and whether you are a manufacturer, importer, distributor or steward.
What Cyber Resilience Act compliance costs and what drives it: the Commission's impact assessment estimates for secure development, self-assessment and third-party assessment per product, the cost of notified body routes, SME fee reductions and support, and ongoing costs over the support period.
The maximum fines under Article 64 for each type of breach, how authorities set the amount, who is exempt, and the market surveillance measures (corrective action, withdrawal, recall, sweeps) that can apply alongside fines.
How to choose and run the conformity assessment route for each product class, when a notified body is needed, how to find and check one, what modules B, C and H involve, and how harmonized standards and EU certification change the route.
When free and open-source software is in scope of the Cyber Resilience Act and who carries the obligations: maintainers versus contributors, monetization, paid support and donations, open-core models, open-source software stewards, and manufacturers that integrate open-source components.
An overview of manufacturer obligations under the CRA: Annex I product requirements and vulnerability handling, the risk assessment, the support period, Article 14 reporting, technical documentation, conformity assessment, the declaration and CE marking, and record keeping.
How to assess readiness for the CRA before December 2027: what to check first given reporting already applies, documenting the risk assessment and justifying non-applicable requirements, which existing products need work, grouping product families, and standards timing.
What a manufacturer based outside the EU must arrange under the CRA: what an authorised representative can and cannot take on, how importers and distributors check products, which CSIRT receives notifications, and one notification per event across a corporate group.
How to decide whether a software update or change makes a product substantially modified under the CRA, with the Commission's examples, why security updates usually do not, and what follows: new conformity assessment, a new support period and legacy products coming into scope.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.