Oct 13, 2026Testing Standards
CRA Compliance Guide: What the EU Cyber Resilience Act Means for Connected Products
What Regulation (EU) 2024/2847 requires, which products are in scope, the CRA dates that matter, reporting duties, penalties and what to prepare.
Regulation (EU) 2024/2847 — the Cyber Resilience Act, or CRA — makes cybersecurity a mandatory condition for placing products with digital elements on the EU market. Adopted on 23 October 2024 and published in the Official Journal on 20 November 2024, it entered into force on 10 December 2024. The CRA works through CE marking: a connected product must meet its essential cybersecurity requirements before it can be placed on the market, alongside the other Union legislation that applies.
What Counts as a Product with Digital Elements
A "product with digital elements" is a software or hardware product, with its remote data processing solutions, including components placed on the market separately. It is covered where its intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Standalone software and firmware are covered in their own right.
Certain products are carved out because another legal framework governs them: medical devices and in-vitro diagnostics, vehicles under type approval, aviation products under civil aviation rules, marine equipment, spare parts replacing identical components, and products developed exclusively for national security or defence. Where other Union rules address the same risks at the same or a higher level of protection, a Commission delegated act can limit or exclude the CRA's application.
Important and Critical Products
Most products follow the standard conformity route; two tiers face stricter assessment. Annex III's "important" products include Class I categories such as smart home assistants and smart home security products like cameras, door locks, baby monitors and alarms, internet-connected toys with social or location features, certain wearables, browsers, password managers, VPN products, operating systems, and routers, modems and switches, plus Class II categories such as hypervisors, firewalls and intrusion prevention systems, and tamper-resistant microprocessors. Annex IV's "critical" products are hardware devices with security boxes, smart meter gateways, and smartcards or similar devices including secure elements. Commission Implementing Regulation (EU) 2025/2392 sets out technical descriptions of these categories, and the Commission can add, move or withdraw categories by delegated act, with at least twelve months' transition for additions.
Key Dates
Date: 20 November 2024; Milestone: Published in the Official Journal
Date: 10 December 2024; Milestone: Entry into force
Date: 11 June 2026; Milestone: Chapter IV on conformity assessment bodies applies
Date: 11 September 2026; Milestone: Reporting obligations apply; the single reporting platform is operational
Date: 11 December 2026; Milestone: Target date for Member States to have a sufficient number of notified bodies
Date: 11 December 2027; Milestone: Main application date; the RED cybersecurity delegated act is repealed from this date
Date: 11 June 2028; Milestone: EU type-examination certificates issued under other legislation remain valid until this date
Products on the market before 11 December 2027 become subject to the CRA only if substantially modified after that date — but the Article 14 reporting obligations apply to all in-scope products, including those already on the market, from 11 September 2026.
Main Obligations for Manufacturers
Manufacturers must design, develop and produce products in line with Annex I's essential requirements, based on a documented cybersecurity risk assessment updated during the support period. Annex I Part I covers product properties: secure by default configuration, no known exploitable vulnerabilities at placement, access controls, confidentiality and integrity of data, availability, minimal attack surfaces and secure data removal. Part II requires vulnerability handling throughout the support period: identifying and documenting vulnerabilities and components — including a machine-readable software bill of materials covering at least the top-level dependencies — remediating vulnerabilities without delay, with security updates separate from functionality updates where feasible and free of charge, a coordinated vulnerability disclosure policy, and a contact address for vulnerability reports.
The support period must be at least five years, or the expected use time if shorter, and its end date must be specified at purchase. Technical documentation and the EU declaration of conformity must be kept for at least ten years or the support period, whichever is longer. Manufacturers must also exercise due diligence on third-party components, designate a single point of contact, provide user information, and affix the CE marking.
Conformity Assessment and CE Marking
The default route is internal control (module A): the manufacturer assesses its own product and draws up the technical documentation and declaration of conformity. Class I important products can self-assess where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial" are applied; otherwise EU-type examination plus internal production control, or full quality assurance, is required. Class II important products always need one of those notified-body procedures or a certification scheme. Critical products must use a European cybersecurity certification scheme once one is designated for their category; until then, Class II procedures apply. Free and open-source software in Annex III categories can self-assess if its technical documentation is made public. Harmonised standards for the CRA are still being developed under a standardisation request covering 41 standards. Assessment routes depend on the product category and standards applied; manufacturers should confirm the applicable route with their compliance service provider.
Reporting from 11 September 2026
Manufacturers must report any actively exploited vulnerability and any severe incident affecting a product's security. Reports go via the single reporting platform run by ENISA, the EU cybersecurity agency, simultaneously to the CSIRT designated as coordinator and to ENISA. The deadlines: an early warning within 24 hours of becoming aware; a fuller notification within 72 hours; a final report within 14 days after a corrective or mitigating measure is available for vulnerabilities, or within one month of the 72-hour notification for severe incidents. Where users are affected, the manufacturer must inform them. These Article 14 obligations started on 11 September 2026, before the 11 December 2027 application date, and cover products already on the market. Open-source software stewards, which sustain open-source projects intended for commercial activity, have lighter duties: a cybersecurity policy, cooperation with market surveillance authorities, and reporting from 11 December 2027.
Interaction with the RED, NIS2 and the GDPR
Radio equipment came first: Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive required internet-connected radio equipment placed on the market from 1 August 2025 to meet cybersecurity essentials, supported by the EN 18031 standards. To avoid overlap when the CRA takes over, that delegated act was repealed with effect from 11 December 2027. Products placed on the market from 1 August 2025 to 10 December 2027 stay under the RED cybersecurity requirements; products placed later fall under the CRA. The CRA complements the NIS2 Directive by securing the products NIS2 entities use, and applies without prejudice to the GDPR. Where sectoral law covers the same risks, the Article 2(5) mechanism can limit the CRA's application rather than duplicate it.
Penalties
Infringements can attract national administrative fines within ceilings set by the CRA: up to EUR 15,000,000 or 2.5% of total worldwide annual turnover of the preceding financial year, whichever is higher, for breaching the Annex I essential requirements or the manufacturer obligations in Articles 13 and 14; up to EUR 10,000,000 or 2% for other obligations; and up to EUR 5,000,000 or 1% for supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities. Micro and small enterprises cannot be fined for missing the 24-hour early-warning deadline, and open-source software stewards are not subject to administrative fines.
What to Prepare
Inventory connected products and components sold separately against Annex III Class I, Class II and Annex IV, and run a gap assessment against Annex I.
Build a documented cybersecurity risk assessment and plan how each requirement is met.
Establish a software bill of materials process and review supplier components, their support periods and due diligence evidence.
Put a coordinated vulnerability disclosure policy and a single point of contact in place, ready for reporting duties — reporting already applies.
Define each support period, prepare to state its end date at purchase, and prepare the technical documentation, EU declaration of conformity and CE marking workflows.
Watch the harmonised standards and delegated acts as they appear.
How LCS Supports This Work
LCS's Global Market Access service coordinates certification and market access projects for Europe and other markets, including test report review, application submission and certificate handling; the Global Market Access page on this site describes the service. The CRA conformity assessment itself, the technical documentation and the EU declaration of conformity remain the manufacturer's responsibility.