Cyber Resilience Act (CRA)

To protect consumers and businesses by embedding cybersecurity into product design and development. The CRA addresses the fact that many products today have inadequate security and rarely get timely updates.

It intends to make it easier for users to identify secure products and trust that devices with a CE marking have met EU cybersecurity standards and make sure to add any relevant details or information that you want to share with your visitors.

Manufacturers must meet essential cybersecurity requirements covering design, production, and post-market support of their devices. They will need to maintain security updates and manage vulnerabilities actively. For “critical” products (those with higher risk, defined by the regulation), a third-party conformity assessment (certification by an accredited body) will be mandatory before placing the product on the market. Less critical products can be self-assessed for compliance, but all products must have a EU Declaration of Conformity stating they meet CRA requirements.

The CRA was adopted in late 2024. It entered into force on 10 December 2024, and has a grace period for industry.

The main obligations will start to apply from 11 December 2027, giving manufacturers a transition period to comply.

Some provisions, like vulnerability reporting obligations, may apply sooner and Smart Regulations will keep you updated.

Once in effect, the CRA will be backed by strong enforcement. Regulators can pull non-compliant products off the market or levy significant fines for breaches. The penalty regime is expected to be similar to EU data protection fines – up to €15 million or 2.5% of global annual turnover (whichever is higher) for serious infringements.

This makes compliance not just a technical issue but a major business priority.