Does the Cyber Resilience Act apply to your product?
On this page
The Cyber Resilience Act (Regulation (EU) 2024/2847, the “CRA”) sets cybersecurity rules for almost every product that contains software and is sold in the European Union. Its reporting duties have applied since 11 September 2026; most other obligations apply from 11 December 2027. This guide walks through the questions that decide whether it applies to you, and how heavy your obligations are.
If you would rather answer a few questions than read, use our free check.
1. Is it a “product with digital elements”?
The CRA covers hardware and software products, and their components sold separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or a network. In practice that takes in:
- installable software and mobile apps;
- connected devices, from cameras and routers to industrial sensors and toys;
- firmware, and software components such as libraries or SDKs that you sell on their own;
- the remote data processing that a product needs to work, such as the cloud back end of a connected device.
A product that never connects to anything, directly or indirectly, is outside the CRA.
2. Do you make it available on the EU market, in a commercial activity?
The CRA applies when a product is placed on the EU market, wherever the manufacturer is based. A company outside the EU selling to EU customers is in scope.
“Commercial activity” matters for open-source software. Free and open-source software developed or supplied outside a commercial activity is not in scope. Once open source is monetised or integrated into a product you sell, the obligations attach to whoever places that product on the market. Organisations that systematically support open-source projects intended for commercial use (“open-source software stewards”) have a lighter regime of their own, and they cannot be fined under the CRA.
3. Pure SaaS: usually out
Software offered only as a service, over the network, is generally outside the CRA; the NIS2 Directive is the text that may apply to the company running it. The exception is remote data processing that belongs to a product: the back end of a connected device or of an installed app is part of that product.
4. Is it covered by another EU product law?
Some products already have their own cybersecurity rules and are excluded, notably:
- medical devices and in vitro diagnostic medical devices;
- motor vehicles and their systems covered by type-approval rules;
- civil aviation products certified under EU aviation safety rules;
- marine equipment;
- products developed exclusively for national security or defence.
Spare parts made to replace identical components of a product are also out.
5. Which class is your product in?
Most products are in the default category. The manufacturer then assesses conformity itself (internal control, “module A”).
Some products are listed as important or critical because a flaw in them would have wider effects:
| Category | Examples from the annexes | How conformity is assessed |
|---|---|---|
| Default | Most apps, games, office software, consumer devices without a listed security function | Self-assessment |
| Important, class I | Operating systems, browsers, password managers, VPNs, routers and modems, identity and access management, smart door locks, security cameras, baby monitors, toys with social-interaction or location-tracking features | Self-assessment only if you apply harmonised standards, common specifications or a certification scheme; otherwise a notified body |
| Important, class II | Hypervisors and container runtimes, firewalls, intrusion detection and prevention systems, tamper-resistant microprocessors and microcontrollers | A notified body, or a certification scheme |
| Critical | Hardware devices with security boxes, smart meter gateways, smartcards and secure elements | A notified body, or a European cybersecurity certification where required |
The precise lists are in Annexes III and IV of the regulation and in Implementing Regulation (EU) 2025/2392, which describes each category technically. Free and open-source products of class I and II may self-assess if their technical documentation is public.
6. Are you the manufacturer?
The heaviest duties fall on the manufacturer: whoever develops or manufactures the product, or has it made, and markets it under their own name or trademark. Importers and distributors have their own, lighter checks. If you sell another company’s product under your brand, or substantially modify it, you count as the manufacturer.
What applies, and when
| Date | What changes |
|---|---|
| 10 December 2024 | The CRA enters into force |
| 11 June 2026 | Rules on notified bodies apply |
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents to ENISA (Article 14), including for products already on the market |
| 11 December 2027 | Everything else: essential requirements, vulnerability handling, SBOM, technical documentation, CE marking. Products placed on the market before this date only need to meet them if they are substantially modified afterwards |
Since September 2026, an actively exploited vulnerability starts a clock: an early warning within 24 hours, a notification within 72 hours, and a final report no later than 14 days after a fix is available. Our guide to the reporting clock explains each step.
Fines can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher, for the essential requirements and reporting duties. Micro and small enterprises cannot be fined for missing the 24-hour deadline, but the duty to report still applies to them.
Where to start
- Make a list of your products and check each one against the questions above.
- For each product in scope, write down its class and how you will assess conformity.
- Build a software bill of materials, so you know what is inside each product. Our SBOM guide explains what the CRA expects.
- Set up the reporting procedure now: the clock has been running since 11 September 2026.
This guide is general information, not legal advice. For borderline cases, read the Commission’s guidance and ask your lawyer.
Sources
- Regulation (EU) 2024/2847, the Cyber Resilience Act, Articles 2, 3, 7, 8, 13, 14, 32, 64 and 71, Annexes III and IV
- European Commission: Cyber Resilience Act
- European Commission: summary of the legislative text