Skip to content
Book a call

EU Cyber Resilience Act · Regulation (EU) 2024/2847

Selling connected products in the EU? Then the CRA applies to them.

The Cyber Resilience Act makes cybersecurity mandatory for almost every product with digital elements on the EU market, wherever it is made. Together with your team, we bring your portfolio to conformity.

Book a CRA readiness callSend an email

Until the CRA fully applies

403 days

11 December 2027 · reporting obligations already apply

01Scope

Does it apply to our products?

Very likely, if you place hardware or software on the EU market that can connect directly or indirectly to a device or network.

  • Robotics and automation
  • Machinery and components with software
  • Charging technology and energy storage systems
  • Connected devices, drones, controllers and sensors
  • IoT and consumer products, software and apps

Exceptions include type-approved vehicles and medical devices: UN R155 or the MDR apply there. We clarify the classification together in the readiness call.

02Deadlines

Reporting already applies, also to products on the market.

Reporting obligations have applied to all products on the market since September 2026. All other obligations follow in December 2027.

  1. 10 Dec 2024

    Entry into force

    The CRA is in force, the transition periods run.

  2. 11 Jun 2026

    Notified bodies

    The rules for conformity assessment bodies apply.

  3. 11 Sep 2026

    Reporting obligations

    Actively exploited vulnerabilities and severe incidents must be reported, also for products already on the market.

  4. 11 Dec 2027

    All obligations

    Essential requirements, conformity assessment and CE marking apply to every product newly placed on the market.

The reporting chain since 11 September 2026

Reports go through ENISA’s single reporting platform to the competent national CSIRT.

24 h

Early warning

as soon as you are aware of an actively exploited vulnerability or a severe incident

72 h

Notification

with first details, impact and the measures taken

14 days

Final report

after a fix is available; for incidents within one month

03Market access

For manufacturers outside the EU

The CRA applies to the product, not to where it is made. Importers and distributors check that a product meets the requirements and work with the manufacturer’s documentation.

  • Technical documentation and EU declaration of conformity
  • A point of contact for vulnerability reports and a support period
  • SBOM and security updates over the support period
  • Optionally an authorised representative in the EU

EU Machinery Regulation

Regulation (EU) 2023/1230 applies from 20 January 2027 and includes protection against corruption: relevant for robotics and machinery.

Radio Equipment Directive · EN 18031

Since 1 August 2025, cybersecurity requirements apply to many internet-connected radio products under Delegated Regulation (EU) 2022/30.

EU Data Act

From 12 September 2026, new connected products must provide access by design to the data they generate.

Automotive

Type-approved vehicles follow UN R155/R156. Components and aftermarket products outside type approval can fall under the CRA.

04Requirements

What the CRA requires

01

Reporting process and PSIRT

A central point of contact, a coordinated vulnerability disclosure policy and a practised reporting chain.

02

SBOM

A machine-readable bill of materials of the software components for every product.

03

Risk assessment per product

A documented cybersecurity risk assessment as the basis for all measures.

04

Security by design

The essential requirements of Annex I, from secure defaults to access control.

05

Vulnerability management

Processes for identifying and fixing vulnerabilities and shipping security updates over the support period.

06

Conformity and documentation

Technical documentation, conformity assessment, EU declaration of conformity and CE marking.

05Services

Our CRA modules

You choose the modules that fit your organisation. Everything is built into your processes and templates.

Ongoing sparring

A sparring partner, around 20 hours a month.

  • Sparring and decision papers
  • Quality gates and architecture reviews
  • Exchange with your security owners

Core modules

The building blocks every manufacturer works with.

  • Product inventory and CRA classification
  • Risk assessment and TARA under IEC 62443
  • PSIRT and reporting chain including a dry run
  • SBOM and HBOM
  • Secure development lifecycle
  • Technical documentation and conformity assessment

Add-ons

As needed.

  • Workshops and training
  • Maturity and audit assessments
  • Independent penetration tests
  • Onboarding further product teams

06Approach

How we could start

  1. 01

    15 minutes

    CRA readiness call

    Free of charge: scope, product category and priorities.

  2. 02

    first months

    Joint review

    Product inventory, processes, roles and a roadmap planned backwards from the deadlines.

  3. 03

    in parallel

    Pilot on one product

    Risk assessment, reporting chain and SBOM for a real product, as a template for the others.

  4. 04

    then scale

    Roll-out

    Further products and teams, at the pace that suits your organisation.

07Case study

What this looks like in practice.

01

Rail and transport technologyCRA programme

CRA programme for a European rail technology company

CRAIEC 62443PSIRTSBOM

Situation

Five months until the reporting obligations and a broad product portfolio to prepare.

Approach

  • Product inventory and classification under the CRA product categories
  • Pilot risk assessment under IEC 62443-4-1/-4-2 as a reusable template
  • Role model with clear responsibilities in the product teams
  • Concept for PSIRT, reporting chain and SBOM
  • Roadmap planned backwards from the CRA deadlines

Result

An approved roadmap with clear responsibilities in the product teams.

08FAQ

What manufacturers ask us.

Does the CRA apply to products already on the market?

The reporting obligations have applied to all products with digital elements on the market since 11 September 2026, including existing products. The other requirements apply to products placed on the market or substantially modified from 11 December 2027.

How do the CRA and IEC 62443 relate?

The harmonised standards for the CRA are still being developed. IEC 62443-4-1 (secure development process) and -4-2 (component requirements) are currently the most robust basis, and we use them as the backbone of the implementation.

Do we need a third-party conformity assessment?

For most products, self-assessment is sufficient. Important products of class II and critical products need a notified body or a certification; for class I it depends on whether harmonised standards are applied. We clarify the category together in the readiness call.

How do we work together with our own teams?

We work inside your processes, tools and templates, alongside your product and security teams, so the work products fit straight into your organisation.

What is at stake: Violations of the essential requirements can be fined up to EUR 15 million or 2.5 % of worldwide annual turnover, whichever is higher.

Contact

CRA readiness: 15 minutes that bring clarity.

Together we clarify whether and how your products are affected, which category applies and what needs to happen first. Free of charge and without obligation.

Book a 15-minute callSend an email

or call us: +49 151 42019537

Moritz Krebbel

Managing Director · Product Security

Automotive and autonomous driving · EU Cyber Resilience Act · Security by design

Andreas Fechner

Managing Director · Enterprise Security

Penetration testing · Security assessments · Digital resilience