CRA – cybersecurity requirements for connected products
The EU Cyber Resilience Act (CRA) sets binding cybersecurity requirements for connected products sold on the EU market. Manufacturers already have to report actively exploited vulnerabilities and severe incidents to the EU's single reporting platform. When the regulation applies in full at the end of 2027, manufacturers, importers and distributors must make sure connected products carry the CE marking. Among other things, this means classifying products into security classes and managing risks and vulnerabilities as the regulation requires. Each security update must also remain available for at least ten years.
The EU Cyber Resilience Act is the first binding EU regulation to set security requirements directly on products. It entered into force on 10 December 2024 and applies in three stages.
| Date | What applies |
|---|---|
| 11 June 2026 | The rules for notified bodies, which assess products in the higher risk classes, apply. |
| 11 September 2026 | Manufacturers must report actively exploited vulnerabilities and severe incidents. |
| 11 December 2027 | All requirements apply. New products must meet the requirements and carry the CE marking. |
Which products and organisations are covered?
The CRA applies to products with digital elements that can be connected, directly or indirectly, to a network and are sold in the EU. The regulation calls them “products with digital elements” (PDEs).
A PDE can be a software or hardware product, together with its remote data processing solutions. Operating systems, mobile apps, computers, network equipment, smart home products, industrial control equipment and internet-connected toys are examples.
Some products are excluded because they already fall under their own rules, including medical devices, vehicles, aviation and marine equipment. Cloud services (SaaS) are generally not covered, unless they are needed for a product to work.
Non-profit open-source development is not covered by the CRA. Foundations and other organisations that support open source used commercially are called stewards and have lighter obligations: they need a policy for secure development, must cooperate with the authorities and must report exploited vulnerabilities. Anyone building a commercial product on open source, however, is fully responsible for the whole product, including the parts that come from others. We recommend keeping a software bill of materials (SBOM) and monitoring key dependencies. Read more about the tools in our article on OWASP.
The CRA applies when a PDE is made available on the EU market in the course of a commercial activity. Where the manufacturer is established does not matter: organisations outside the EU are covered too if their products are made available on the EU market.
The CRA divides the parties involved into three categories.
- Manufacturers carry the greatest responsibility. This also applies to anyone who puts their own brand on a product made by someone else.
- Importers must check that products from countries outside the EU meet the requirements.
- Distributors must check that the manufacturer and importer comply with the CRA, and that the product carries the CE marking and the right documentation.
An importer or distributor that sells the product under its own name or brand becomes the manufacturer under the CRA. The same applies to anyone who substantially modifies a product and places the result on the market.
Product categories and assessment
Products fall into four classes, with different security requirements and different ways of assessing them.
| Class | Examples | How the product is assessed |
|---|---|---|
| Default | Most apps, software and connected products | The manufacturer's own assessment |
| Important, class I | Password managers, browsers, VPNs, antivirus, routers | Own assessment if harmonised standards are followed, otherwise a notified body |
| Important, class II | Firewalls, intrusion detection and prevention, hypervisors | A notified body or an EU certification |
| Critical | Smart cards, smart meter gateways, hardware devices with security boxes | A notified body or an EU certification |
Important and critical products face additional security requirements and stricter rules for assessing whether a PDE meets the requirements. High-risk AI systems may also be subject to specific rules.
Build risk management into development
The manufacturer must ensure that a PDE is designed, developed and produced in line with the CRA's essential cybersecurity requirements. This requires a documented and ongoing assessment of the cybersecurity risks, covering both the product's intended use and reasonably foreseeable misuse.
The product must:
- have no known exploitable vulnerabilities when it is placed on the market.
- be secure by default, i.e. ship with secure default settings and protect data with, for example, encryption and appropriate access control.
- be updatable through secure security updates, automatic as a rule.
- protect the confidentiality, integrity and availability of data.
- limit attack surfaces and the impact of incidents.
- record and monitor relevant security-related activity.
- allow data and settings to be securely deleted or transferred.
Third-party components, including open source integrated into a PDE, are also subject to these requirements. If a vulnerability is found in a component, it must be reported to whoever maintains the component. If the manufacturer develops a fix, that must be passed on too.
Put working vulnerability handling in place
The manufacturer must have a process for receiving, fixing and disclosing vulnerabilities. It must identify and document the product's components and vulnerabilities, including a software bill of materials (SBOM) that covers at least the top-level direct dependencies.
Vulnerabilities must be handled and remedied without delay. Once a security update is available, information about the affected products, the impact, the severity and the remedy must be published. Security updates must be provided without delay and, as a rule, free of charge. They must remain available for at least ten years after release, or for the whole support period, whichever is longer.
Prepare to report vulnerabilities and severe incidents
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents that affect the security of the product. Reports go through the EU's single reporting platform to ENISA and to the CSIRT in the country where the manufacturer is established. In Sweden that is CERT-SE, which since 1 July 2026 is part of the National Cyber Security Centre at the National Defence Radio Establishment (FRA). The deadlines are:
- Within 24 hours: an early warning.
- Within 72 hours: a notification with more information.
- Final report: no later than 14 days after a fix is available for a vulnerability, or within one month for a severe incident.
Affected users must also be informed within a reasonable time. Organisations therefore need to decide in advance who assesses incidents, who decides on reporting and who handles contact with authorities and users.
Document and demonstrate conformity
Before the product is placed on the EU market, the manufacturer must draw up technical documentation that includes, among other things:
- a general description of the product.
- a description of its design, development and production.
- the vulnerability handling processes.
- the system architecture, where relevant.
- the documented cybersecurity risk assessment.
The product must then go through a conformity assessment under the CRA. For products in the default category, the manufacturer's own internal control is normally allowed. Some important and critical products require assessment by an independent body or an approved quality system.
The CRA's requirements are often worded in general terms. Manufacturers therefore need to be able to show a serious, reasonable and documented effort to meet them based on the guidance available. The work should be an ongoing part of the product's whole life cycle.
Once the product has been assessed as meeting the requirements, the manufacturer must draw up an EU declaration of conformity and affix the CE marking in an appropriate place.
The technical documentation and the EU declaration must be kept for at least ten years after the product was placed on the market, or for the whole support period, whichever is longer. Back the documentation up in several places: being unable to produce it can lead to sanctions even if the product otherwise meets the requirements.
Give users the right information
The product must come with user information that includes, among other things, the manufacturer's contact details, a contact point for reporting vulnerabilities, the product's intended purpose and security properties, known risks, the end date of the support period, and a link to the EU declaration of conformity.
Market surveillance authority and assessment bodies
A Swedish government inquiry (SOU 2025:115) has proposed that the Swedish Post and Telecom Authority (PTS) becomes the market surveillance authority. PTS would check that products with digital elements meet the CRA's cybersecurity requirements as well as its requirements on marking and information, documentation, and reporting of vulnerabilities and incidents. The inquiry also proposes that Swedac appoints the bodies allowed to assess products. The supplementary Swedish law has not yet been decided.
Sanctions for breaches
Breaches of the CRA can lead to large fines. The regulation sets the following caps; the higher amount applies.
| Breach | Maximum fine |
|---|---|
| The essential security requirements or the reporting requirements | EUR 15 million or 2.5 percent of global annual turnover |
| Other obligations, for example for importers and distributors | EUR 10 million or 2 percent of global annual turnover |
| Incorrect or misleading information to authorities | EUR 5 million or 1 percent of global annual turnover |
A product may also have to be corrected, withdrawn or recalled from the EU market.
The most important safeguards against sanctions are to classify the product and the organisation correctly, build risk management into the development process, document every assessment, put working incident and vulnerability handling in place, carry out the right conformity assessment, and never put the CE marking on a product without the evidence to back it.
How the CRA relates to NIS2
NIS2 and the Swedish Cybersecurity Act set requirements on organisations and how they manage the security of their network and information systems. The CRA sets requirements on the products they buy and sell. The two complement each other: an organisation covered by NIS2 must manage risks in its supply chain, and CE marking under the CRA becomes a way of knowing that a product meets a baseline.
How to get started
- Take stock of your products. Which products do you sell in the EU, and which risk class do they fall into?
- Set up reporting now. Decide who receives vulnerability reports and severe incidents, and who reports within 24 hours. The requirements already apply.
- Produce an SBOM. Generate it automatically in your development process and monitor dependencies continuously.
- Decide the support period. How long can you provide security updates, and how will customers receive them?
- Do a gap analysis against the CRA's cybersecurity requirements. Plan the work so that it is done before 11 December 2027.
- Set requirements for your suppliers. Make sure components and software you buy in from other suppliers meet the CRA.