On this page
The Cyber Resilience Act sets EU cybersecurity rules for products with digital elements, including many smart home devices, wearables and connected toys. It covers commercially supplied hardware and software whose intended or reasonably foreseeable use involves a direct or indirect data connection to another device or network. Some products are excluded, so first check whether the rules cover your product.
The Cyber Resilience Act applies in stages. Manufacturer reporting duties began on 11 September 2026. The main product obligations apply from 11 December 2027. This guide explains the dates, reporting deadlines and supplier arrangements brands need to plan for.
What the Cyber Resilience Act Is
The Cyber Resilience Act is Regulation (EU) 2024/2847. It sets security requirements for product development and duties for handling vulnerabilities after sale. Once the main requirements apply, the CE mark will also show compliance with the CRA, alongside other CE legislation.
The scope includes finished products and some components sold separately. Products covered by certain sector laws are excluded, such as medical devices and vehicles. A data connection is a reason to check scope. It does not prove the product is covered.
Key Dates
| Date | What applies |
|---|---|
| 10 December 2024 | The regulation entered into force |
| 11 June 2026 | Rules on notifying conformity assessment bodies apply |
| 11 September 2026 | Manufacturers must report actively exploited vulnerabilities and severe incidents |
| 11 December 2027 | The main obligations apply in full |
These dates come from Article 71 of the regulation. The European Commission’s Cyber Resilience Act page summarizes the main ones. The reporting duties cover products already on the market, not only new ones.
Reporting Under the Cyber Resilience Act
Under the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents that affect the security of covered products. Reports go through the CRA Single Reporting Platform. The Commission sets these deadlines:
Within 24 hours of becoming aware
Submit an early warning.
Within 72 hours of becoming aware
Submit the main notification with the required assessment and available information.
Final vulnerability report
Submit it no later than 14 days after a corrective or mitigating measure is available.
Final severe-incident report
Submit it within one month of the 72-hour notification.
Reporting needs named people who receive, assess and escalate security information. Agree how your factory, firmware developer and support team tell you about problems. Make sure you can get the technical details for a report within the deadline.
What Manufacturers Must Do
The Cyber Resilience Act requires manufacturers to assess cybersecurity risks and document how they address them. Annex I sets out the product-security and vulnerability-handling requirements. In practice, that means:
- No known exploitable vulnerabilities when the product is released.
- A secure default configuration, with the option to reset it.
- Protection of stored and transmitted data.
- Security updates for the support period, kept separate from feature updates where possible.
- A software bill of materials covering software components and at least the top-level dependencies.
- A published way for anyone to report vulnerabilities.
The support period must match how long the product is expected to be used. It is generally at least five years. If expected use is shorter, support covers that shorter period. Longer-lived products need longer support. Tell buyers the support end date at purchase and budget for the work.
Product Categories and Conformity Assessment
The Cyber Resilience Act allows internal assessment for many products. Products whose core functions fall into the important or critical categories in Annexes III and IV face extra conditions. Know your category before you fix the testing budget.
| Category | Assessment route |
|---|---|
| Default products | Internal assessment is available, backed by the required technical evidence and documentation. |
| Important, class I | Includes routers, smart home security products and internet-connected toys with interactive or location features. Internal assessment is allowed only if you apply the relevant harmonized standards, common specifications or an applicable European cybersecurity certification scheme. Otherwise a notified body must assess the product. |
| Important, class II and critical | These need third-party assessment or an applicable European cybersecurity certification route, with some specific exceptions. |
Penalties are set nationally. Breaches of the essential requirements carry a maximum of 15 million euros or 2.5% of worldwide annual turnover, whichever is higher.
What the Cyber Resilience Act Means for Brands That Outsource
A business that has a product designed or made and sells it under its own name or trademark is the manufacturer. Outsourcing production or firmware does not pass those duties to the factory. Secure access to the technical information and update tools you will need for the whole support period.
- Know what is inside. Get a software bill of materials from your firmware supplier and module makers.
- Own the update path. Agree who can build, sign and push security updates, and for how long.
- Write it into the contract. Set patch response times and support periods with your factory and firmware partners.
- Set up a security contact. Publish an address for vulnerability reports and decide who answers it.
- Decide the support period. Price it into the product, because updates cost money.
- Check your category. If your product is class I or above, plan the conformity route now.
Some radio products already fall under cybersecurity requirements in the Radio Equipment Directive. Those rules have their own scope and procedures. One approval does not cover both.
Build Security Responsibilities Into the Product Plan
The Cyber Resilience Act makes security part of developing and supporting a product for the EU market. Reporting duties already apply. The main obligations start in December 2027. Settle scope, support period and assessment route early, so they go into supplier contracts and the development schedule.
If you are building smart home hardware or another connected product, our electronics production package helps you set firmware ownership, supplier documentation and update responsibilities with your manufacturing partners. It also plans CE and FCC certification alongside development. Our electronics manufacturing process guide shows where these decisions fit.
