Can we wait until December 2027 to start?

No. Reporting duties have applied since 11 September 2026. A flaw attackers are using or a serious incident needs an early warning within 24 hours of learning about it, through the EU reporting platform. Set up your reporting now while you prepare for the main rules in December 2027.

Does every product need independent conformity assessment?

No. Products that are not on the EU’s lists of important or critical products can be checked by the manufacturer itself. Important products in class I can be too, but only with the official EU standards applied in full or an EU certification scheme. Class II and critical products need a notified body, an authorised independent organisation, or an EU cybersecurity certificate.

Will a penetration test meet all CRA requirements?

No. A penetration test, a controlled attempt to break into a product, finds weaknesses. The CRA also covers development, updates, reporting and documents.

Does the CRA apply to companies outside the EU?

Yes. It applies to products sold in the EU, wherever the manufacturer is based. Importers that bring those products into the EU have their own duties.

Is open-source software covered by the CRA?

Only in some cases. Non-commercial open-source software is outside the CRA, but open-source parts inside a product you sell belong on your list of software parts.

What are the CRA’s deadlines?

The CRA entered into force on 10 December 2024. Its rules for notified bodies, the independent organisations that carry out conformity assessment, have applied since 11 June 2026. Manufacturers’ reporting duties started on 11 September 2026, and the other requirements apply from 11 December 2027.

EU product security law

Cyber Resilience Act: requirements for your digital products

The Cyber Resilience Act (CRA) is an EU law for connected hardware and software, from smart devices to apps. Products must meet its security rules to be sold in the EU.

Discuss CRA preparation Take the free CRA assessment

Type: EU product security regulation
Reporting applies from: 11 September 2026
Main duties from: 11 December 2027
Who it reaches: Manufacturers, importers and distributors

Who it applies to

Companies putting digital products on sale

Manufacturers selling connected hardware or software in the EU, wherever they are based.
Importers bringing these products into the EU.
Distributors selling these products to EU buyers.

Medical devices and in vitro diagnostic medical devices covered by the MDR or IVDR are excluded under Article 2(2)(a) and (b). Motor vehicles and their parts under EU type-approval rules and certified civil aviation products are excluded too. So are marine equipment and products made only for defence or national security. Each exclusion covers the product, not the whole company. Non-commercial open-source software is outside the CRA.

Get an initial indication of whether CRA applies to one product, its category and the likely conformity assessment route.

Take the free CRA assessment

Dates to plan for

CRA reporting and product deadlines

10 December 2024
The Cyber Resilience Act entered into force.
11 September 2026
Reporting duties began applying.
11 December 2027
The main product security obligations begin applying.

What it asks of you

Build security into product development and support

Check each product’s risks
Define the product, intended use and security risks before choosing the safeguards it needs.
Develop and test securely
Include security requirements in design, coding, testing and release decisions.
Track the software parts
Maintain a list of software components and check how their security flaws affect your product.
Handle flaws and reports
Provide a route for vulnerability reports and arrange remediation. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security through the EU single reporting platform.
Plan updates and conformity assessment
Define support, prepare security updates and keep the documents needed to show your product meets the rules.

How we help

Coordinate product security and CRA readiness

We establish which requirements apply and coordinate preparation with your product team. We help address security gaps, implement vulnerability handling and prepare the technical documentation and testing for the applicable conformity assessment.

CRA ComplianceImplement CRA product security requirements and prepare for conformity assessment, with support for ongoing compliance. Penetration TestingFind exploitable security weaknesses and give your team a clear plan for fixing them. Vulnerability ManagementOngoing vulnerability identification, expert risk prioritisation and remediation advice, with progress tracking and verification.

Common questions

Related regulations and standards

IEC 62443
Industrial security standards for the companies that run, build and supply industrial systems. Makers of industrial equipment can draw on that work when preparing for the CRA.
NIS2
The EU cybersecurity law for organisations in critical sectors. The CRA covers the products you sell; NIS2 covers how your company protects its own systems.

Free 30-minute call

Plan your products’ CRA preparation

Bring your product list to a free 30-minute call to discuss reporting duties and product preparation.

Discuss CRA preparation hello@guardera.tech