CRA readiness for digital products and services

The Cyber Resilience Act is EU Regulation (EU) 2024/2847, which establishes, for the first time, mandatory cybersecurity requirements for all products with digital elements in the EU internal market. Manufacturers must demonstrate security throughout the support lifecycle – from development (“security by design”) through vulnerability management to security updates during operation. Conformity is demonstrated through the CE marking: As of December 11, 2027, there will be no market access in the EU without CRA conformity.

The Cyber Resilience Act applies to all hardware and software products that can be connected directly or indirectly to a device or network – from IoT sensors to control systems and connected machines, to firmware and apps. It applies to manufacturers, as well as authorized representatives, importers, and distributors who offer such products in the EU. Important: Anyone who markets a purchased product under their own name or makes significant modifications to it is considered a manufacturer- with all the associated obligations. For machinery and equipment manufacturers who integrate components, this is the rule, not the exception. Cloud and platform components are also included if they are necessary for the product’s function – such as the backend that controls a machine or deploys updates. Exceptions include products subject to their own sector-specific regulations, such as medical devices, vehicles, and aviation. For machine and plant manufacturers that offer remote access, cloud connectivity, or OTA updates, the CRA is therefore generally relevant.

As of September 11, 2026, reporting requirements for actively exploited vulnerabilities and serious security incidents take effect; the Cyber Resilience Act will be fully implemented as of December 11, 2027. The reporting requirements apply to all products already on the market – regardless of when they were placed on the market. The full requirements (conformity assessment, CE marking, technical documentation) apply to products placed on the market starting in December 2027; A significant change to an existing product may be considered a new placing on the market- that is, a change that alters the product’s safety risk or expands its intended use. Merely fixing bugs and providing security updates do not, by definition, trigger this.

Manufacturers must demonstrably integrate cybersecurity into development, production, and operation. This includes a cybersecurity risk assessment for each product, secure default configurations, a software bill of materials (SBOM), a process for the coordinated disclosure of vulnerabilities, and free security updates throughout the support period (at least five years; for long-lasting products such as machinery and equipment, this period is correspondingly longer. A shorter support period is permissible only if the product is objectively used for a shorter period; the determining factor here is the reasonable expectations of users, not the manufacturer’s own product lifecycle), as well as technical documentation, conformity assessment, and the EU Declaration of Conformity – depending on the product class, in collaboration with a notified body. In addition, there is a reporting obligation: Actively exploited vulnerabilities and serious incidents must be reported via ENISA’s central reporting platform to the relevant CSIRT – in Germany, the BSI – and to ENISA: an early warning must be issued within 24 hours of becoming aware of the issue, and a detailed report must be submitted within 72 hours. The final report must be submitted within 14 days of providing an update or workaround for vulnerabilities, and within one month of the 72-hour report for security incidents. Additionally, affected users must be notified. A prerequisite for this is a functioning vulnerability monitoring system based on a well-maintained SBOM.

The most efficient way to get started is with a structured impact analysis: Which products fall under the CRA, which product class do they belong to (standard, important Class I/II, or critical), and where are there gaps in compliance with the requirements? This results in a prioritized roadmap that first ensures readiness for reporting and then establishes SBOMs, vulnerability management, update processes, and documentation by December 2027. Our CRA Assessment provides exactly this first step: In about two weeks, you’ll receive product classification, a gap list, and an implementation plan at a fixed price.

The greatest risk is not the fines, but market access: Products placed on the market on or after December 11, 2027, require a conformity assessment, technical documentation, an EU Declaration of Conformity, and CE marking. If any of these are missing, the product may not be placed on the EU market – for a mechanical engineering company with a backlog of orders, this effectively means a halt to deliveries. Market surveillance authorities can also restrict the product’s availability and order its withdrawal or recall; fines of up to 15 million euros or 2.5 percent of global annual turnover – whichever is higher – may also be imposed. The second deadline – which is often overlooked – is important: The reporting requirements take effect as early as September 11, 2026, and also apply to products that have long been in the field. Anyone who waits until 2027 to comply will therefore miss not one, but two deadlines.