What is the Cyber Resilience Act?
The CRA, Regulation (EU) 2024/2847, sets horizontal cybersecurity requirements for products with digital elements made available on the EU market.
A product lifecycle, not a one-time form
Start by defining the product and its intended and reasonably foreseeable use. Security requirements, vulnerability handling, technical documentation and support must relate to that product and the releases actually supplied.
Separate the legal dates
The Act entered into force on 10 December 2024. Manufacturers' Article 14 reporting applies from 11 September 2026; most other obligations apply from 11 December 2027. Open-source steward reporting under Article 24(3) has the later application date.
Practical preparation
Record your role, scope and classification decisions. Connect releases to SBOMs, risk and test records, vulnerability decisions and update evidence. Identify the applicable conformity route before preparing declarations or CE marking.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.