Loading...
Regulation on horizontal cybersecurity requirements for products with digital elements
The Cyber Resilience Act introduces mandatory cybersecurity requirements for all products with digital elements placed on the EU market. It establishes obligations for manufacturers, importers, and distributors across the entire product lifecycle, with phased enforcement through December 2027.
71
Articles
8
Annexes
EUR 15M
Max Fine
Dec 2027
Full Enforcement
10 December 2024
Regulation entered into force
11 June 2026
Conformity assessment body notification obligations apply (Chapter IV)
11 September 2026
Manufacturer reporting obligations begin - vulnerability and incident reporting to ENISA (Art. 14)
11 December 2027
Full application - all essential cybersecurity requirements and CE marking mandatory
11 June 2028
Transition period ends for existing EU type-examination certificates
Products must be designed and developed with minimal vulnerabilities, include automatic security update mechanisms, and undergo risk assessments. Security by design and by default.
Manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours. Applies from 11 September 2026. Requires Software Bill of Materials (SBOM) and real-time vulnerability monitoring.
Manufacturers must identify and document components in machine-readable format, covering at least top-level dependencies. Internal document - not required to be published.
Security updates must be provided for a minimum of 5 years from date of placing on market, or throughout expected product lifetime if shorter.
Products must display CE marking to indicate conformity. Mandatory from 11 December 2027 - products without CE mark cannot be legally sold in the EU.
EUR 15M or 2.5% global turnover
Non-compliance with Annex I essential cybersecurity requirements and obligations under Art. 13 and Art. 14 (Art. 64).
EUR 10M or 2% global turnover
Non-compliance with obligations under Art. 18-23, Art. 28, Art. 30-33, Art. 39, 41, 47, 49, 53 (Art. 64).
EUR 5M or 1% global turnover
Supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities (Art. 64).
Schedule a consultation with our regulatory experts to assess your CRA compliance posture and build a practical roadmap.