EA Digital Solutions

Cyber Resilience Act

Cyber Resilience Act: reporting required since 11 September 2026. We set it up.

The Cyber Resilience Act applies to manufacturers of products with digital elements, including standalone software and apps placed on the EU market, wherever the manufacturer is based. The reporting obligations have applied since 11 September 2026, all other obligations follow on 11 December 2027. We check with you whether your product is in scope, set up the 24-hour reporting process and build SBOM, dependency monitoring and a secure update process into your development.

  • Software, apps, connected devices
  • For EU and non-EU manufacturers
  • Reply within 24 hours
Send a request

In short

The Cyber Resilience Act (Regulation (EU) 2024/2847) requires manufacturers of hardware and software placed on the EU market to ensure cybersecurity across the product lifecycle. Since 11 September 2026 they must report actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours, then a final report. This also applies to products already on the market. From 11 December 2027 the remaining obligations apply, including security by design, vulnerability handling, SBOM, support period and CE marking.

Key facts

Reporting since 11 September 2026
Actively exploited vulnerabilities and severe incidents affecting the security of the product must be reported through the single reporting platform to the competent CSIRT and ENISA (Art. 14).
24 hours, 72 hours, final report
Early warning within 24 hours, notification within 72 hours. Final report for vulnerabilities no later than 14 days after a corrective measure is available, for incidents within one month of the notification.
Also for products already on the market
The other obligations apply to older products only after a substantial modification; the reporting obligations, however, apply to all products in scope, including those placed on the market before December 2027 (Art. 69).
From 11 December 2027: everything else
Essential cybersecurity requirements (Annex I), vulnerability handling with SBOM, a support period with security updates, technical documentation, conformity assessment and CE marking.
Non-EU manufacturers included
What counts is whether the product is made available on the EU market, not where the manufacturer is established.
Fines
For breaches of the essential requirements and the obligations under Art. 13 and 14, up to EUR 15 million or 2.5 % of worldwide annual turnover, whichever is higher (Art. 64).

As of 26 October 2026 · General information, not legal advice.

Who is in scope

  • Manufacturers of software distributed as a product: desktop and mobile apps, installable software, firmware.
  • Manufacturers of connected hardware and IoT devices, including the related software and remote data processing.
  • Companies outside the EU offering such products in the EU, as well as importers and distributors, who have obligations of their own.
  • Open-source software developed outside a commercial activity is not covered. Whoever monetises open source in the course of a commercial activity is a manufacturer; open-source software stewards have separate, lighter obligations.

Whether your product is in scope and which category it falls into depends on the individual case. Pure software as a service is generally covered by NIS2 rather than the CRA, unless it is remote data processing for a product. We go through it with you in the first call; if in doubt, a lawyer confirms the legal classification.

What we do for you

  1. 1

    Clarify scope

    Free first call: which products, which markets, which role. Afterwards you know what has applied since September 2026 and what is due by December 2027.

  2. 2

    24-hour reporting runbook

    A runbook with owners, deputies and templates for early warning, notification and final report, plus an intake channel for vulnerability reports from outside.

  3. 3

    SBOM and dependencies in the build

    A software bill of materials generated with every build and monitoring of dependencies for known vulnerabilities, with alerts to the people responsible.

  4. 4

    Secure update process

    Signed updates, traceable releases, security updates separate from feature updates, a documented support period.

  5. 5

    Documentation for conformity

    Risk assessment, technical documentation and evidence prepared so that you can carry out the conformity assessment yourself or hand it to a notified body.

For certification and for products that need assessment by a notified body we work with specialised partners.

Check for free first

Free checklist

Cyber Resilience Act checklist: 15 points for software and device makers

Cyber Resilience Act checklist: 15 points for software and device makers

For products with digital elements you offer in the EU. The first five points concern the reporting obligation in force since 11 September 2026; the rest must be in place by 11 December 2027.

Reporting, vulnerability handling, SBOM, updates and documentation: the 15 points for the Cyber Resilience Act, as a printable PDF.

Enter your e-mail to read the whole thing

Download for free — enter your e-mail

You are also subscribing to our newsletter. Unsubscribe any time.

Frequently asked questions

Does the Cyber Resilience Act apply to our software?

If you offer software or a connected device as a product on the EU market, very likely: the CRA covers products with digital elements, including standalone software and apps. Pure SaaS without a related product is generally not covered. We clarify this in the first call.

What applies already?

Since 11 September 2026, the obligation to report actively exploited vulnerabilities and severe incidents, also for products already on sale. All other obligations apply from 11 December 2027.

We are based outside the EU. Does this affect us?

Yes, if you make your product available in the EU. What counts is the market, not where your company is registered.

Do we have to publish an SBOM?

According to the sources we checked, no: manufacturers must draw up and document a software bill of materials, but publishing it is not required. It must be available to market surveillance authorities on request.

Do you give legal advice?

No. We implement the technical and organisational measures and prepare the documentation. For the legal classification we recommend a lawyer if in doubt.

Sources

Related services