What is the Cyber Resilience Act?
The Cyber Resilience Act, CRA for short, is Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements; its German version also calls it the Cyberresilienz-Verordnung. It was published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024 (Art. 71(1)). As a regulation it applies directly in every Member State; the manufacturers' obligations need no German implementing act.
The CRA is product law. It sets out what a product must be like when it is placed on the EU market, and what the manufacturer owes over its lifetime after that. As with other internal market rules, it ends in an EU declaration of conformity (Art. 28) and the CE marking (Art. 30).
Which products and companies does the CRA apply to?
The CRA applies to products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)). A product with digital elements means software or hardware together with its remote data processing solutions, including components sold separately (Art. 3(1)). That covers most devices with firmware: controllers, gateways, sensors, routers, meters.
The main burden lies with the manufacturer (Art. 13). Importers and distributors have their own duties to check (Art. 19 and 20). Anyone who places a product on the market under their own name or substantially modifies it is treated as a manufacturer (Art. 21 and 22).
- Excluded (Art. 2(2) to (7))
- Medical devices and in vitro diagnostic medical devices (Regulations (EU) 2017/745 and 2017/746), type-approved vehicles (Regulation (EU) 2019/2144), aviation products with a certification under Regulation (EU) 2018/1139, marine equipment under Directive 2014/90/EU, identical spare parts, and products developed exclusively for national security or defence purposes.
- Devices with USB, Ethernet, fieldbus or radio
- A cable interface is a physical data connection too. When a device with USB, RS-485 or CAN falls under the CRA is set out in the article on the data connection.
When does the CRA apply?
The CRA applies in stages (Art. 71(2)). Devices placed on the market before 11 December 2027 only have to meet the product requirements if they are substantially modified after that date (Art. 69(2)). This means each individual device: every unit placed on the market from 11 December 2027 must meet the requirements, even if the model has been sold for years. The reporting obligation under Art. 14 also applies to older devices (Art. 69(3)).
| Date | What applies |
|---|---|
| 10 December 2024 | Entry into force of the Regulation |
| 11 June 2026 | Chapter IV, Art. 35 to 51: notification of conformity assessment bodies |
| 11 September 2026 | Art. 14: reporting of actively exploited vulnerabilities and severe incidents, also for products already on the market |
| 11 December 2027 | Everything else: Annex I, SBOM, support period, conformity assessment, CE marking |
What do manufacturers have to do under the CRA?
- 1
Assess the risks
An assessment of the cybersecurity risks that feeds into planning, design, development, production, delivery and maintenance (Art. 13(2)).
- 2
Meet Annex I, Part I
Among other things: placed on the market without known exploitable vulnerabilities, a secure by default configuration, security updates possible, protection against unauthorised access (Annex I, Part I, point 2(a) to (d)).
- 3
Handle vulnerabilities
Identify and document components and vulnerabilities, with an SBOM in a commonly used, machine-readable format that covers at least the top-level dependencies (Annex I, Part II, point 1), and remedy vulnerabilities without delay (point 2).
- 4
Set the support period
It reflects the time the product is expected to be in use and is at least five years, unless the product is in use for a shorter time (Art. 13(8)).
- 5
Assess and document conformity
Conformity assessment under Art. 32, technical documentation (Art. 31), EU declaration of conformity, CE marking. Keep the documentation and the declaration for ten years or for the support period, whichever is longer (Art. 13(13)).
- 6
Report
Actively exploited vulnerabilities and severe incidents through ENISA's reporting platform: early warning within 24 hours, notification within 72 hours (Art. 14).
Which product classes does the CRA define?
Most products are default products whose conformity the manufacturer assesses itself (module A, Art. 32(1)). Annex III lists important products of classes I and II, Annex IV critical products. Class I includes operating systems, under Implementing Regulation (EU) 2025/2392 also real-time operating systems (point 11), routers (point 12) and microcontrollers with security-related functionalities (point 14). For class I the manufacturer may only assess itself if it fully applies harmonised standards, common specifications or a European certificate at assurance level at least ‘substantial’; otherwise it needs EU-type examination (modules B and C) or full quality assurance (module H) (Art. 32(2)).
What penalties does the CRA set?
| Infringement | Fine of up to (whichever is higher) |
|---|---|
| Annex I, manufacturers' obligations (Art. 13) and reporting obligation (Art. 14) | EUR 15 million or 2.5 % of worldwide annual turnover (Art. 64(2)) |
| Authorised representatives, importers, distributors, declaration of conformity, CE marking, technical documentation, conformity assessment (Art. 18 to 23, 28, 30 to 32) | EUR 10 million or 2 % (Art. 64(3)) |
| Incorrect or incomplete information to authorities and notified bodies | EUR 5 million or 1 % (Art. 64(4)) |
What is the difference between the CRA and NIS2?
The CRA places obligations on the manufacturer of a product. NIS2, implemented in Germany in the BSI Act (BSIG), places obligations on essential and important entities above a certain size in the listed sectors, for example risk management under § 30 BSIG. A manufacturer can be both: under the CRA for its products, under NIS2 for its own operations.
Which CRA requirements can be checked on the firmware?
Some points of Annex I can be read technically from the shipped firmware: which components it contains in which version (the SBOM from Part II, point 1), which known vulnerabilities attach to them (Part I, point 2(a)), whether credentials or keys are shipped with it, and which protection mechanisms are missing. Other points, such as the vulnerability handling process or the support period, are in no file. The statement of conformity is yours to make as the manufacturer.
Questions
Does the CRA also apply to devices that are already being sold?
The product requirements apply to products placed on the market from 11 December 2027, and to older products only after a substantial modification (Art. 69(2)). Since 11 September 2026 the reporting obligation under Art. 14 also applies to products already on the market (Art. 69(3)).
Does every product need an SBOM?
Every product in scope from 11 December 2027, as part of the technical documentation. You do not have to publish it. Format and depth are covered in the article on the SBOM requirements.
Is there a German law for the CRA?
The manufacturers' obligations are set out directly in the Regulation. The Member States lay down the penalties (Art. 64(1)) and designate the market surveillance authorities (Art. 52(2)). Reports under Art. 14 go to the CSIRT of the Member State of the main establishment; for a main establishment in Germany that is CERT-Bund at the BSI.