Under the Cyber Resilience Act, manufacturers must design, build and maintain products with digital elements so they meet the EU's essential cybersecurity requirements, and then prove it.
In practice that is four jobs. A documented risk assessment and a technical file with a software bill of materials (SBOM). The conformity assessment your product's class demands, then an EU declaration of conformity with the CE marking. A stated support period, with vulnerability handling for all of it. And fast reports on actively exploited vulnerabilities and severe incidents.
The law is Regulation (EU) 2024/2847, explained in the Commission's guidance for manufacturers. Reporting has applied since 11 September 2026. The full regulation applies from 11 December 2027.
Product compliance is outside my field. My field is outbound sales, where packaging decides whether tactics land, and for an EU manufacturer the CRA answer is now part of that packaging.
The legal sections below rest on the regulation and the Commission's pages; the final section covers what your sales team should tell buyers. This is not legal advice.
When do the CRA deadlines start for manufacturers?
Article 71 of the regulation and the Commission's CRA implementation page give three dates.
| Date | What starts | What a manufacturer needs on that day |
|---|---|---|
| 11 June 2026 | Rules for notifying conformity assessment bodies (Chapter IV) | Nothing for you to file. Notified bodies (independent assessors approved by a Member State) can now be set up, so if your product needs one, start talking to one early |
| 11 September 2026 | Reporting obligations (Article 14) | A named owner, an EU reporting route and a way to spot the two reportable events |
| 11 December 2027 | CRA fully applies | Products that meet the essential requirements, pass conformity assessment and carry the CE mark |
What has to happen before a product goes on the market?
The work starts with a risk assessment that decides how each essential requirement gets built in; the Commission's summary of the legal text says that assessment belongs in the technical documentation. The Commission's secure design examples are security by default, access control, cryptography and automatic updates.
Scope also covers components, such as the chips and operating systems inside a product. For bought-in parts, Recital 34 lists due diligence options scaled to risk: check the CE marking, check for regular security updates, check the European vulnerability database, or run your own tests. If you find a flaw in someone else's part, you tell its maker and fix it in your product.
Which products are default, important or critical?
The class decides how much outside review a product needs. The Commission's conformity assessment page says most products only need a self-assessment. Annex III splits important products into two classes, Annex IV lists critical ones, and Article 32 sets each route.
| Group | Examples from Annexes III and IV | Assessment route (Article 32) | Likely review burden |
|---|---|---|---|
| Default | Smart speakers, computer games, memory chips, mobile apps | Self-assessment by the manufacturer | Lowest: your own team and your own file |
| Important, Class I | Operating systems, routers, anti-malware software, password managers | Self-assessment only if harmonized standards, common specifications or an EU certification scheme are applied in full; otherwise a notified body | Medium, high if no standard is available |
| Important, Class II | Hypervisors, firewalls, intrusion detection systems, tamper-resistant microcontrollers | Always third party: a notified body, or EU certification at "substantial" assurance level or higher (the middle of three levels) | High |
| Critical | Smart meter gateways, smart cards, secure elements | EU certification where required, otherwise a notified body; third party in any case | Highest |
How does CRA conformity assessment work?
Harmonized standards are the Class I shortcut. The Commission's standardization page says they give a presumption of conformity (apply one in full and your product is presumed to meet the requirements it covers), and its request M/606 covers 41 standards, some horizontal (for all products) and some product-specific.
That shortcut is not open yet. At the time of writing, no CRA harmonized standard had been cited in the Official Journal. That comes from the state-of-play page of cyberresilienceact.eu, an independent guide run by i46 s.r.o.
CEN-CENELEC confirms the Commission has issued a standardization request to the European standards bodies for CRA deliverables, and in 2026 it was still recruiting rapporteurs for vertical standards.
Recheck the Commission's standardization page before you commit to a route. Until one covering your product is cited, a Class I manufacturer should plan for a notified body, unless common specifications or an EU certification scheme cover the product.
Every route ends with an EU declaration of conformity, the CE marking and instructions for use.
What must manufacturers report and how fast?
Two events trigger a report. The Commission's reporting page sets the clock.
| Trigger | Within 24 hours | Within 72 hours | Final report |
|---|---|---|---|
| Vulnerability under active exploitation | Early warning | Full notification | Within 14 days of a corrective or mitigating measure becoming available |
| Severe incident affecting product security | Early warning | Full notification | Within one month of the 72-hour notification |
The clock starts when you become aware of the event. You file once on the CRA Single Reporting Platform, addressed to the CSIRT (the national cyber incident response team) of your main establishment. A flaw nobody is exploiting goes through normal vulnerability handling instead.
How does the CRA treat open source software and stewards?
Only open source supplied as part of a commercial activity is in scope, says the Commission's open source page; software its makers do not monetize does not count. Contributors to projects they are not responsible for are out. A manufacturer that sells an open source product carries the full manufacturer duties. Article 32(5) gives one relief: if that product is important (Class I or II) and its technical documentation is public, self-assessment is allowed.
Stewards are a new category: legal persons that give sustained support to open source meant for commercial use. They need a cybersecurity policy, must cooperate with market surveillance authorities, and report from 11 December 2027, per the reporting page.
What should manufacturers prepare now?
Start with scope. If a product with digital elements is sold in the EU, monetized open source included, assume the CRA applies until you have classified it.
Article 2 sets out exclusions, such as medical devices, motor vehicles, civil aviation and marine equipment already covered by their own EU rules, identical spare parts, and products made only for national security or defence, so read it before you classify a product.
Then check every product:
- Scope and class: default, Class I, Class II or critical?
- Support period: what end date will the buyer see at purchase?
- Documentation: a risk assessment, a technical file and a software bill of materials. Annex I, Part II requires the SBOM in a machine-readable format covering at least top-level dependencies.
- Reporting: who files within 24 hours, and which CSIRT receives it?
- Route: self-assessment, standards, certification or notified body?
Smaller firms can use the support on the Commission's MSME page: Member State training, testing, sandboxes and EU funding.
What should your sales team tell EU buyers about CRA status?
Importers and distributors must check your CE marking and documentation before they sell your product (Articles 19 and 20), so expect the question to reach your deals.
I have seen the same message draw a 2% reply rate at one company and 7.5% at another, because buyers check the sender before they answer. A CRA question is that check in writing, from a buyer's security or procurement team. "We are working on it" fails it.
Give sales one status note per product, approved by whoever owns compliance:
- Class and route, for example "Class I; notified body planned, as no harmonized standard is cited yet"
- What is live today (your reporting process) and the date you plan to carry the CE marking under the CRA
- The support period end date, as the buyer will see it at purchase
- The single point of contact for vulnerability reports, which Annex II requires in the user information
- Whether you share the SBOM; Annex II leaves that to the manufacturer
Keep "CRA compliant" out of the note until the assessment is done and the CE marking is on the product. A buyer's security team can check it.
Your buyers run this check on you, the same way you should put hard questions to any outbound partner before you hire one. If your team cannot send that note today, the weak spot in your EU deals is the packaging, not the pipeline. Fix that first.
The note belongs in a follow-up once a buyer's technical team is involved, not in the first touch, the same pacing I use when running LinkedIn and email as one sequence. Contacting new EU buyers cold falls under separate rules, covered in whether cold email is legal.
If you make connected products for EU buyers and want help wording your CRA status in outreach, book a call. Legal questions still go to your counsel.
Questions manufacturers ask about the CRA
What happens to products sold before December 2027?
Article 69 says anything placed on the EU market before 11 December 2027 only has to meet the CRA if it is substantially modified later. Reporting is the exception: the Article 14 duty covers every product with digital elements, however old.
Does the CRA apply to manufacturers outside the EU?
Yes. It covers products made available on the EU market, wherever they were made. A manufacturer outside the EU can appoint an authorized representative in the EU by written mandate (Article 18), and the importer must check the product and its documentation before selling it (Article 19).
How long must a manufacturer support a product and keep its documentation?
Article 13 sets a support period of at least five years, shorter only when the product's expected lifetime is shorter. The technical file and declaration of conformity stay available for at least 10 years after placement, or for the whole support period if longer.
What are the fines for breaking the CRA?
Article 64 caps fines at EUR 15,000,000 or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements or the manufacturer and reporting duties. Article 64(10) exempts micro and small enterprises from fines for missing the 24-hour early warning, and open source stewards from fines altogether.
What is a notified body under the CRA?
It is an independent conformity assessment body that checks your product and technical file when the CRA rules out self-assessment. A Member State assesses, designates and monitors it, then notifies it to the Commission. Once notified, bodies are published on the EU's NANDO website.