EU Cyber Resilience Act overview

Purpose and structure

The CRA applies to consumer and industrial products when they meet its scope conditions. Begin by identifying the product and whether an exclusion applies. The manufacturer’s duties and available conformity assessment routes then depend on its role and the product’s classification.

The topic pages below explain each of these questions, with the legal definitions, examples and source references needed for a product-specific assessment.

Core concepts

Choose a reading path

Product leads, security engineers and conformity-assessment teams need different parts of the regulation. The following reading paths match those responsibilities.

• Product and compliance leads: establish which product and versions are supplied, whether the CRA applies, the legal role, product category, and relevant application dates.
• Security and engineering teams: connect the architecture, assets, trust boundaries, components, and update design to the cybersecurity risk assessment.
• Vulnerability-handling teams: maintain component and vulnerability records, assess product impact, prepare remedies, and evaluate Article 14 reporting triggers as soon as relevant facts emerge.
• Technical-documentation and assessment teams: assemble product-specific evidence, verify the standards and assessment route, and keep the file consistent with the released version.

For example, a connected device may depend on embedded firmware, an application, and manufacturer-controlled remote processing. The product definition comes first; risk assessment, component records, and documentation then use the same defined boundary.

Reading order for manufacturers

First establish whether the product is in scope. The pages below then explain the responsible parties, product categories and applicable requirements. Check the reporting rules separately: Article 14 applies from 11 September 2026, before the main product requirements.

1. Start with Products in Scope and Placing on the Market .
2. Identify the economic-operator role in Roles and Duties .
3. Classify the product using Product Classification and Regulation 2025/2392 Technical Descriptions .
4. Read the product and process duties in Essential Cybersecurity Requirements .
5. Read about the relevant standards in Standards and Harmonised Standards and Product Standards by Category .
6. Continue with Cybersecurity Risk Assessment, Technical Documentation and User Information and Instructions.
7. Prepare Article 14 reporting with Vulnerability Reporting and Article 14 Reporting Readiness .
8. Use the key dates to separate reporting, notified-body, transition, and full-application timing.

Products in scope

This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.

Regulation (EU) 2024/2847, Article 2(1)

A product with digital elements can be software, hardware, a separately placed software or hardware component, and the product's remote data processing solution. Remote processing is part of the product only when it is designed and developed by, or under the responsibility of, the manufacturer and the product would not perform one of its functions without it.

The CRA does not turn every digital service into a product with digital elements. A website or cloud service outside the manufacturer's product responsibility is different from remote processing that the product needs in order to work. Explicit exclusions are handled on the scope page; the broader product-law background is handled on the basics page.

Roles and product categories

A manufacturer, importer and distributor may each have duties for the same product. Product classification answers a different question: which conformity assessment routes are available or required. Important and critical product categories depend on the product’s core functionality.

• Default products remain subject to the CRA, but normally use the internal-control conformity route.
• Important products are listed in Annex III and divided into Class I and Class II.
• Critical products are listed in Annex IV and can face certification or stricter third-party assessment routes.
• Commission Implementing Regulation (EU) 2025/2392 gives technical descriptions for important and critical product categories.

A product is not important or critical merely because it contains a component that appears in a listed category. The relevant question is whether the whole product has the core functionality of that category.

Essential requirements and standards

Article 6 requires both the product and the manufacturer’s vulnerability-handling processes to meet Annex I. Its two parts set out these requirements separately. A harmonised standard whose reference is published in the Official Journal can provide presumption of conformity for the requirements it covers.

The detailed pages explain the structure of Annex I and how standards can help show conformity. Essential Cybersecurity Requirements and Standards and Harmonised Standards.

Reporting and vulnerability handling

Vulnerability handling is a lifecycle duty. Reporting is a narrower event-triggered duty. From 11 September 2026, Article 14 applies when a manufacturer becomes aware of an actively exploited vulnerability in the product or a severe incident affecting the product's security.

• Early warning: within 24 hours after the manufacturer becomes aware.
• Notification: within 72 hours after the manufacturer becomes aware, unless the relevant information was already provided.
• Final report for an actively exploited vulnerability: no later than 14 days after a corrective or mitigating measure is available.
• Final report for a severe incident: within one month after the 72-hour incident notification.

Key dates

The CRA was published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024. Its application is phased, so the reporting and conformity-assessment-body dates arrive before full application.