Research: referenced in the ENISA SME CRA Survey 2026.
Regulation (EU) 2024/2847
The CRA is the first European regulation that establishes mandatory cybersecurity requirements for all products with digital elements (PDE) placed on the EU internal market — from smart home devices to industrial control systems.
Entry into force
Dec 2024
Full obligation
Dec 2027
Max. fine
€15M / 2.5%
Min. support
5 years
Scope
Applies to all manufacturers, importers, and distributors who place products with digital elements (hardware or software) on the EU market — regardless of where the company is headquartered worldwide.
Legal basis
Regulation (EU) 2024/2847. Unlike directives, a regulation applies directly and uniformly in all EU member states — no national transposition required.
Product definition (PDE)
Products with digital elements include all hardware and software with a network-capable component or data interface. From industrial SCADA systems to consumer apps.
Exceptions
Exemptions include medical devices (MDR/IVDR), vehicles (UNECE R155), aviation (EASA), and open-source software without commercial activity.
Regulation (EU) 2024/2847 enters into force. The phased application clock starts.
The rules on notifying authorities and notified bodies start to apply. This sets up who may certify products — it places no new obligation on manufacturers themselves.
Manufacturers must report actively exploited vulnerabilities and severe incidents : early warning within 24h, notification within 72h, final report 14 days after a fix (vulnerabilities) or one month after the notification (incidents). This is the only manufacturer obligation that lands on this date — and it applies to all products already on the market, including legacy products.
Everything else applies: Annex I essential requirements, conformity assessment, technical documentation, CE marking and the Declaration of Conformity. Non-compliant products may no longer be placed on the EU market.
Common misconception: On 11 September 2026, only the reporting obligation under Art. 14 becomes mandatory — and it applies to existing products already on the market. The remaining obligations (Annex I, conformity assessment, CE marking) only apply from 11 December 2027.
11 Sep 2026 — SRP reporting is live. The 24 h / 72 h / final-report filing cadence applies to every product with digital elements already on the EU market.
Applies to all products with digital elements (PDE) placed on the EU market.
Manufacturers, importers, distributors, PDE, vulnerability, security update, support period.
Divided into Default, Important Products (Class I & II) and Critical Products.
Conformity assessment, technical documentation, EU Declaration of Conformity, CE marking, support period (min. 5 years).
Actively exploited vulnerabilities and serious incidents must be reported to ENISA and CSIRT within 24h.
Importers ensure that only compliant products are placed on the market.
Distributors verify CE marking and cooperate on corrective measures.
Products complying with harmonised standards are presumed to conform.
Default: Self-assessment. Class I: Notified Body or harmonised standard. Class II: Notified Body mandatory.
Formal document per Annex V confirming conformity with the CRA.
Must be clearly visible, legible and permanently affixed (Annex VI).
Member states designate competent authorities with inspection and intervention powers.
Fines up to €15 million or 2.5% of worldwide annual turnover — whichever is higher.
Products must not have exploitable security vulnerabilities when placed on the market. Evidence through vulnerability scan before release.
Shipped with secure default configurations. No default passwords. Unnecessary services and ports disabled.
Authentication and authorisation mechanisms. MFA where appropriate. Session management. Protection against unauthorised access.
Protection of sensitive data in transit (TLS 1.2+) and at rest (AES-256). No unnecessary data storage.
Protection of data and command integrity. Input validation, checksums, digital signatures.
Processing only data necessary for the intended purpose. GDPR data minimisation principle.
Limiting the impact of denial-of-service attacks. Rate limiting, resource quotas, graceful degradation.
Limiting external interfaces to what is necessary. Least-privilege principle. Removal of unused components.
Design for resilience: logging, alerting, isolation mechanisms. Fail-safe behaviour during security incidents.
Secure mechanism for software updates (e.g. signed OTA updates). Documented update channels. Rollback capability.
Use of secure, current communication protocols. Prohibition of deprecated protocols (TLS 1.0/1.1, SSLv3).
Verification of software component integrity. Software signing, verification at startup. SBOM for all components.
Recording and documentation of all vulnerabilities and components. Current SBOM. CVE feed monitoring for all third-party dependencies.
Publicly accessible Coordinated Vulnerability Disclosure policy. security.txt on website. ENISA registration if required.
SLAs for patches: Critical (24–72h), High (7 days), Medium (30 days). Documented and communicated process.
Periodic SAST, DAST and penetration tests. Documented results and remediation actions.
Machine-readable SBOM (CycloneDX or SPDX) available to authorities on request. Updated with every release.
The CRA Requirement Library in this system contains all 28 requirements with guidance and compliance status. Go to requirement library →
Self-assessment
Examples
Smart home devices, simple IoT sensors, consumer software
Requirements
Third-party assessment or harmonised standard
Examples
Browsers, password managers, SIEM systems, firewalls, VPN software
Requirements
Mandatory: Notified Body
Examples
Industrial control systems (SCADA), operating systems, chips with security function, industrial routers
Requirements
| Annex | Title |
|---|---|
| Annex I | Essential Cybersecurity Requirements |
| Annex II | User Information |
| Annex III | Important Products (Class I & II) |
| Annex IV | Critical Products |
| Annex V | EU Declaration of Conformity |
| Annex VI | CE Marking |
| Annex VII | Technical Documentation |
| Annex VIII | Assessment procedures |
Annex VII — Technical Documentation in Detail
Purpose, main functions, target audience, intended operating environment.
Architecture diagrams, security-relevant design decisions, threat models.
Full cybersecurity risk analysis (e.g. STRIDE, PASTA) for the product.
Test plans, scan results (SAST/DAST/pen test), remediation evidence.
Determine product class
Check for each product whether it qualifies as Default, Class I or Class II. Annex III and IV of the CRA provide the categories.
Manage productsPerform gap analysis
Assess the status of all 28 CRA requirements for each product. Identify gaps in documentation, processes and technology.
Go to requirement libraryCreate org-level policies
SDL, CVD policy, incident response process — these requirements are fulfilled once at company level and inherited by all products.
Go to policy libraryTechnical documentation
Create per product: general description, architecture, risk analysis (STRIDE), SBOM and test results per Annex VII.
Open dossiersSet up reporting process
Mandatory from Sep 2026: process for 24h reporting of actively exploited vulnerabilities to ENISA and national CSIRT.
Incident response policyEOL planning & support
CRA requires at least 5 years of support. Plan EOL dates for all products and ensure security updates can be provided.
Lifecycle managementOther regimes that run alongside the CRA
The CRA regulates products with digital elements and their manufacturers. NIS2 (Directive (EU) 2022/2555) and DORA (Regulation (EU) 2022/2554) are parallel regimes for the organisations that operate such products: NIS2 for essential and important entities, DORA for financial entities. They do not replace your CRA obligations, but customers in those sectors may ask for your CRA evidence to support their own supply-chain risk management.
Official Regulation
Regulation (EU) 2024/2847 in the EU Official Journal