EU Cyber Resilience Act: Fifteen Key Questions and How Firms Can Respond

The EU Cyber Resilience Act was published on 20 November 2024 as the bloc's first horizontal cybersecurity law for products with digital elements. Manufacturers placing hardware or software on the EU market face staged duties from 11 September 2026 for vulnerability reporting and 11 December 2027 for most remaining obligations.

Who needs to care about the CRA

Authors Liu Xinyu and Chen Runping review the EU Cyber Resilience Act (CRA), published on 20 November 2024. It is the EU's first horizontal cybersecurity law for products with digital elements, covering hardware and software, with the stated aim of raising security on the EU market and cutting vulnerability risk. Firms that sell consumer electronics, IoT devices, industrial control systems, or software into the EU face design-to-lifecycle security work, legal-document updates, vulnerability handling, incident response, and conformity assessment.

The CRA has extra-territorial reach. It applies to manufacturers that make products with digital elements available on the EU market, whether or not they are established in the EU; to authorised representatives, importers, and distributors in the EU; and, in defined cases, to open-source software stewards. Sectors called out for Chinese exporters include consumer electronics (smartphones, wearables, smart home hardware and companion software), industrial and infrastructure products (ICS, smart meters, security systems, routers, firewalls), software (operating systems, applications, embedded software, and remote data processing that is part of product function, including some SaaS), and automotive aftermarket connectivity, charging gear, and standalone apps. Upstream suppliers to those EU-facing lines also need to meet the same chain of duties or risk being dropped from the supply chain.

Penalties and market measures

Article 64 sets a graded fine scale. Breaches of Annex I essential cybersecurity requirements and of Articles 13 (manufacturer duties) and 14 (vulnerability reporting) can draw up to EUR 15 million or 2.5% of the undertaking's worldwide annual turnover in the prior financial year, whichever is higher. Breaches of Articles 18 to 23 (other economic operators), 28 (declaration of conformity), 30(1)-(4) (CE marking), 31(1)-(4) (technical documentation), 32(1)-(3) (conformity assessment), 33(5), and 39, 41, 47, 49, and 53 can draw up to EUR 10 million or 2%. Supplying incorrect, incomplete, or misleading information to a notified body or market surveillance authority can draw up to EUR 5 million or 1%. Market surveillance authorities may also recall, withdraw, or ban products. Article 65 adds representative actions by consumer bodies. Micro and small enterprises, and open-source software stewards, may be exempted or have fines reduced in specified cases.

What counts as a product, and how it is classed

Article 3(1) defines a product with digital elements as any software or hardware product that can connect, directly or indirectly, by logical or physical data connection, including remote data processing solutions needed for the product to function (cloud services and APIs designed by the manufacturer). That covers phones, tablets, watches, smart locks, cameras, routers, industrial sensors, smart meters, operating systems, applications, embedded software, firmware, and companion remote-control clouds. Article 2 excludes some products to limit overlap with other EU law.

Products fall into three risk classes with different conformity paths. General products, the majority, may use internal control assessment without a third party. Important products split into Class I (consumer smart locks, baby monitors, smart toys, wearable health devices, and similar) and Class II (firewalls, intrusion detection and prevention systems, and similar). Class I may self-assess if applicable harmonised standards, common specifications, or an EU cybersecurity certification scheme are applied in full; otherwise third-party assessment is mandatory. Class II always requires third-party assessment. Critical products follow the strictest path. The Commission will refine class lists by delegated and implementing acts.

New duties

Core manufacturer and operator duties include security requirements in design and development; vulnerability handling throughout the support period, with timely security updates; incident response and notification; conformity assessment, technical documentation, and an EU declaration of conformity; CE marking; user information on security properties, support duration, and update policy; and supply-chain security, including a software bill of materials (SBOM).

Timeline

The CRA entered into force on 10 December 2024 (the twentieth day after publication). Articles 35 to 51 on notified bodies apply from 11 June 2026. Article 14 on vulnerability reporting applies from 11 September 2026 to all products still in their support period, including products already on the market. Most remaining substantive duties, including design security, conformity assessment, CE marking, and economic-operator obligations, apply from 11 December 2027. Transitional EU-type examination certificates and approvals issued under other EU harmonisation law for cybersecurity expire on 11 June 2028 unless they lapse earlier.

Product requirements

Annex requirements include security by design and secure by default across design, development, and production; vulnerability discovery and fix processes; authentication, access control, encryption, and secure boot where needed; authentic, intact, and timely software updates; logging and monitoring of security-relevant internal activity, with a user opt-out; third-component supply-chain assessment; and clear user information on security features, limits, and support duration.

Vulnerability handling and updates

Annex I Part II and Articles 13 and 14 set vulnerability handling, the first major duty to apply (11 September 2026). The support period must be at least five years unless the product's nature justifies a shorter intended lifetime (Article 13). Manufacturers must run a intake channel (security contact, bug bounty, or similar), publish a coordinated disclosure policy, and ship updates with an explanation of content and importance. For an actively exploited vulnerability they must send an early-warning notice within 24 hours, a vulnerability notification within 72 hours, and a final report within 14 days after remediation of that exploited issue. Article 69(3) extends reporting to products placed on the market before 11 December 2027 if they remain in support.

Incident response

Under Articles 13 and 14, once a manufacturer knows of an incident that affects product security it must analyse impact, take corrective steps (updates or mitigations), notify affected users and, where appropriate, all users, and for serious incidents notify the designated CSIRT coordinator and ENISA. Exporters need member-state notice clocks as well as the CRA text.

Conformity assessment

General products may use Module A internal control (Article 32(1) and Annex VIII Part I): technical documentation against Annex I, an EU declaration of conformity, and CE marking. Class II important products (firewalls, IDS/IPS, hypervisors, and similar) require a notified body under Module B+C or Module H regardless of standards use. Class I important products (operating systems, routers, password managers, VPNs, and similar) may use Module A if applicable harmonised standards, common specifications, or a European cybersecurity certification scheme are applied in full; otherwise third-party assessment is required. Critical products (hardware security modules, smart-meter gateways, security chips, smart cards, and similar) must use the EU Common Criteria scheme (EUCC) where applicable, or Module B+C, Module H, or another allowed path. Technical files typically include security design records, a cybersecurity risk assessment, SBOM, test reports, and vulnerability-management policy. Firms should identify class and contact a qualified notified body early.

Economic operators

Manufacturers carry the core load: Annex I compliance (including no known exploitable vulnerabilities at delivery), risk assessment, free security updates for at least five years (fees only in special cases), SBOM maintenance, due diligence on third-party and open-source components, mandatory incident reporting, conformity assessment, technical documentation, the declaration of conformity, and CE marking. An authorised representative established in the EU holds documentation, talks to market surveillance, and supports recalls within the written mandate. Importers must verify assessment, CE marking, and documentation before placing a product, mark their name and contact, keep a copy of the declaration, correct non-compliance, tell the manufacturer about vulnerabilities without delay, and tell market surveillance if the product poses a significant cybersecurity risk. Distributors must check CE marking, the declaration, instructions, and importer contacts; keep non-compliant goods off the market until fixed; and notify the manufacturer and, for significant risk, market surveillance. An importer or distributor that sells under its own name or trademark, or that makes a substantial modification, becomes a manufacturer. Exporters without an EU entity need an authorised representative and aligned importers and distributors.

Open-source software

FOSS supplied outside commercial activity is outside the CRA. Recitals 15 and 18 treat as commercial activity charging for the software or for support beyond cost recovery, monetising other services on the software platform, conditioning use on personal-data processing that is not solely for security, compatibility, or interoperability, or taking donations beyond design and supply cost. Voluntary donations without profit intent, non-profit use of surplus for non-profit aims, and hosting in a public repository alone do not count as commercial activity.

Article 24 creates the open-source software steward: a legal person that systematically and continuously supports development of specific open-source software. Stewards must document a cybersecurity policy for secure development and vulnerability handling, answer market-surveillance information requests, and report actively exploited vulnerabilities and severe incidents. They do not affix CE marking and do not take on manufacturer conformity assessment. Article 64(10) shields stewards from administrative fines and other pecuniary penalties, though corrective measures remain available. The same paragraph also shields micro and small enterprises from pecuniary penalties for missing the 24-hour early-warning deadline; other breaches, including Annex I, still carry fines.

Firms serving the EU market should map product class, support-period length, SBOM and reporting channels, and operator roles against the 11 September 2026 and 11 December 2027 dates.