The EU Cyber Resilience Act puts product makers on a 24-hour clock

Companies that sell smartwatches, baby monitors, business software, and other connected products in the European Union now have 24 hours to warn authorities after they learn that a vulnerability in one of those products is being actively exploited.

‍The deadline comes from the EU Cyber Resilience Act (CRA), formally Regulation (EU) 2024/2847, the EU's first horizontal cybersecurity law for products with digital elements. Earlier EU cybersecurity laws such as NIS 2 and DORA focus on how organizations operate. The CRA regulates what they ship, placing responsibility for the security of hardware and software on the manufacturers, importers, and distributors that put those products on the EU market, wherever they are based.

The CRA's Article 14 reporting obligations took effect on Sept. 11, 2026, and the law's full set of requirements applies from Dec. 11, 2027. Below, Vanta explains who the law covers, what it requires, and what preparation involves.‍

What is the EU Cyber Resilience Act?

Regulation (EU) 2024/2847 entered into force on Dec. 10, 2024. The law covers products with digital elements and products whose intended or foreseeable use involves direct or indirect data connections to devices or networks. This includes hardware and software and extends across each product's entire lifecycle. ‍

The definition is deliberately broad. It covers connected consumer devices such as baby monitors and smartwatches, business hardware, mobile and desktop apps, operating systems, and software libraries and components. There are exceptions, but by and large, the law spreads obligations across the supply chain.

According to the European Commission, the law's primary purpose is to shift responsibility for security onto the companies that place products on the market, rather than leaving it to users. ‍ 

How is the CRA different from NIS 2 and DORA?‍ 

The CRA regulates products, while NIS 2 and DORA regulate organizations and how they operate. NIS 2 sets cybersecurity rules for essential and important entities, and DORA does the same for financial firms, so a company can be in scope of all three for different reasons.

Who does the CRA apply to?

The CRA applies to any company that places a covered product on the EU market, wherever it is based. Obligations fall on three roles in the supply chain:‍

• Manufacturers carry the primary obligations: secure design, technical documentation, conformity assessment, and vulnerability handling.
• Importers can only place CRA-compliant products on the EU market, and they must verify that the manufacturer met its obligations before doing so.
• Distributors must act with due care, which means confirming that the CE marking and required documentation are present before they distribute a product.‍

Some products and organizations are treated differently:‍

• Products covered by sector rules: Article 2 excludes products already governed by sector-specific rules, such as medical devices, in vitro diagnostic devices, motor vehicles, civil aviation, and marine equipment.
• Open source software stewards: Organizations that provide systematic and sustained support for open source software intended for commercial use, without placing a product on the market themselves, follow lighter rules under Article 24. Their reporting obligations begin on Dec. 11, 2027.

EU Cyber Resilience Act timeline: Key dates

Cyber resilience act compliance has been phased in across four key dates.

• Dec. 10, 2024: CRA entered into force.
• June 11, 2026: Chapter IV of the CRA applies, meaning conformity assessment bodies can be notified ahead of full application.
• Sept. 11, 2026: CRA Article 14 reporting obligations begin.
• Dec. 11, 2027: The CRA's main obligations apply in full. ‍ 

What does the CRA require?

The CRA sets requirements across a product's full lifecycle. Manufacturers must build products that meet the essential cybersecurity requirements, handle vulnerabilities for as long as the product is supported, report actively exploited vulnerabilities and severe incidents under Article 14, and pass a conformity assessment before applying the CE marking.‍

Essential cybersecurity requirements

Annex I of the CRA lists the security properties every covered product must have when it reaches the market. They include:‍

• Secure by design: Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on the risks.
• Secure by default: Products must ship with a secure default configuration, including the ability to reset the product to that original state.
• No known exploitable vulnerabilities: Products cannot be placed on the market with known exploitable vulnerabilities.
• Access and data protection: Products must protect against unauthorized access and protect the confidentiality and integrity of the data they store, transmit, or process.
• Limited attack surface: Products must be designed to limit attack surfaces, including external interfaces.
• Security logging: Products must record and monitor relevant internal activity, such as access to or changes to data, services, or functions. 

Vulnerability handling and SBOM

The CRA treats security as ongoing work, not a one-time check at launch. Throughout the support period, manufacturers must:‍

• Identify and document vulnerabilities: This includes maintaining a software bill of materials (SBOM), a machine-readable list of the product’s components that covers at least its top-level dependencies.
• Fix vulnerabilities without delay: Remediation includes providing security updates.
• Provide free security updates: Updates must be free of charge and come with advisory messages that tell users what action to take.
• Run a coordinated vulnerability disclosure policy: Manufacturers must put a policy in place and enforce it.
• Disclose fixed vulnerabilities: Once a security update is available, manufacturers must publicly share information about the vulnerabilities it fixes.‍ 

Article 14 reporting

Article 14 reporting obligations have applied since Sept. 11, 2026. Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's CRA Single Reporting Platform on a fixed timeline:

• ‍Early warning: Within 24 hours of becoming aware of the vulnerability or incident.
• Full notification: Within 72 hours.
• Final report: Within 14 days of a fix becoming available for an actively exploited vulnerability, or within one month of the notification for a severe incident.‍

Manufacturers submit one notification to the CSIRT designated as coordinator, and unless exceptional circumstances apply, the information is made available to ENISA at the same time.  

Conformity assessment and CE marking

Before applying the CE marking, manufacturers must show through a conformity assessment that a product meets the CRA's requirements. The route depends on the product's category:‍

• Default products: Most products fall here, and manufacturers can assess conformity themselves.
• Important products, class I: Self-assessment is allowed only if the manufacturer applied harmonized standards, common specifications, or a European cybersecurity certification scheme. Otherwise, a third-party assessment is required.
• Important products, class II: These require a notified body or a European cybersecurity certificate at an assurance level of at least “substantial.”
• Critical products: These may require mandatory European cybersecurity certification once the relevant delegated acts and certification schemes apply.‍

Annex III of the CRA lists important products, and Annex IV lists critical products. Once the assessment is complete, the manufacturer draws up the EU declaration of conformity and affixes the CE marking.  

Support period and penalties

Manufacturers must set a support period that reflects how long each product is expected to be in use, generally at least five years. A shorter period is allowed only when the product's expected use time is shorter.

Breaching the essential requirements or the Article 13 and 14 obligations can bring fines of up to 15 million euros or 2.5% of total worldwide annual turnover, whichever is higher.  

How should companies prepare for the CRA?

Preparing for the CRA starts at the product level. Five steps can begin now, before the harmonized standards are final:

1. Inventory which products are in scope. Companies need to identify every product with digital elements they place on the EU market.
2. Classify each product. Each product is default, important (class I or II), or critical, and that classification sets its conformity assessment route.
3. Set up a coordinated vulnerability disclosure process. Manufacturers need a workflow that can meet the 24-hour early warning and 72-hour notification deadlines. Only actively exploited vulnerabilities and severe incidents must be reported under Article 14.
4. Map software dependencies and produce an SBOM. The SBOM must document all top-level dependencies at a minimum, with indirect dependencies mapped where practical.
5. Track the harmonized standards. ETSI is developing standards that may support the CRA, but not every ETSI standard creates a CRA obligation. The ones to follow are those formally identified for CRA implementation.‍

"Until you know which of your products are in scope and whether each is default, important, or critical, you can't determine your conformity route, your documentation burden, or even who in the organization owns the obligation," said Niya Raina, a governance, risk, and compliance (GRC) subject matter expert at Vanta.‍

"Sequence the work by deadline rather than treating the CRA as a single 2027 event," Raina said. Because the reporting obligations are already in effect, she said, the vulnerability disclosure process is the immediate priority, and scoping, dependency mapping, and the SBOM are also safe to start now. Detailed control mapping should wait until the harmonized standards are final.

What comes next for the CRA

The CRA's remaining obligations take effect on Dec. 11, 2027, and some of the technical detail behind them is still being written. ETSI and other European standards bodies are finalizing the harmonized standards manufacturers will use to demonstrate conformity.

The CRA also joins an already crowded EU rulebook. Many companies with products in scope are covered by NIS 2 as entities, and financial firms answer to DORA as well. Each of these laws expects security controls to be monitored and documented over time, which is the work continuous control monitoring and automated evidence collection are designed to support. Neither replaces the CRA's product-specific obligations, from SBOMs to CE marking.

‍The stakes are significant. Breaching the essential requirements or the Article 13 and 14 obligations can bring fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.

‍FAQs

Has the Cyber Resilience Act been passed?

Yes. Regulation (EU) 2024/2847 entered into force on Dec. 10, 2024. Article 14 reporting obligations began on Sept. 11, 2026, and the full set of requirements applies from Dec. 11, 2027.

What is the difference between NIS 2 and the CRA?

NIS 2 is entity-level: It regulates how organizations operate, requiring policies for supply chain security, vulnerability management, and cybersecurity awareness. The CRA is product-level: It regulates products with digital elements once they're placed on the EU market. A company can be in scope of both for different reasons.

Does the CRA apply to open source?

Partly. Open source stewards, meaning legal persons who provide systematic and sustained support for open source software intended for commercial use without placing a product on the market themselves, fall under a lighter regime in Article 24 rather than full manufacturer obligations. Their reporting obligations under Article 24(3) begin on Dec. 11, 2027, rather than with the Article 14 manufacturer reporting obligations that began on Sept. 11, 2026.

Does the CRA apply to non-EU companies?

Yes. The CRA applies to any company that places a covered product on the EU market, regardless of where it is based.

This story was produced by Vanta and reviewed and distributed by Stacker.