Cyber Resilience Act compliance

The Cyber Resilience Act applies to manufacturers, importers and distributors of hardware and software products with digital elements sold in the EU. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, the other requirements from 11 December 2027.

  • EU Cyber Resilience Act (CRA)
  • 2024/2847
  • Requirements in the catalogue: 16
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Annex I, Part I

    Design, develop and ship products securely: secure by default, protecting confidentiality, integrity and availability, with security updates.

  • Annex I, Part II

    Handle vulnerabilities: a software bill of materials, timely remediation and a coordinated disclosure policy.

  • Art. 13(8)

    Set a support period that reflects how long the product is expected to be used, at least five years unless its expected use is shorter.

  • Art. 14

    Report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, a notification within 72 hours and a final report later; inform users.

  • Art. 28–32

    Assess conformity, draw up the EU declaration of conformity and affix the CE marking.

  • Art. 19–20

    Importers and distributors check that products meet the requirements before selling them.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The catalogue's requirements, linked to your policies, evidence and owners.

  • Crosswalks from ISO 27001 and from NIS2 to the CRA, so security work already done counts.

  • Fasttrack marks the CRA as applying when you place products with digital elements on the EU market, with both dates.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • Essential cybersecurity requirements for products4
  • Vulnerability handling3
  • Incident and vulnerability reporting3
  • Conformity assessment and CE marking3
  • Obligations of manufacturers, importers and distributors3

Related frameworks: NIS2 ISO 27001

Common questions

Does the CRA apply to software?

Yes. Software sold as a product counts, including apps and firmware. Software provided purely as a service is mostly outside it and falls under NIS2 instead, and free and open-source software developed outside a commercial activity is excluded.

Where do the 24-hour reports go?

To the CSIRT designated as coordinator and to ENISA, through a single reporting platform.

Is an SBOM required?

Yes. Manufacturers draw one up for each product, covering at least its top-level dependencies, in a commonly used machine-readable format. It belongs in the technical documentation; publishing it is not required.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt EU Cyber Resilience Act in a free trial, link the evidence you already have and see what is still missing.

Start a free trial