EU Cyber Resilience Act (Regulation (EU) 2024/2847)

Record: software-cert-031 — EU Cyber Resilience Act
Issuing body / enforcer: EU legislature; enforcement by national market-surveillance authorities, coordinated with ENISA; notified bodies for higher-assurance product classes
Jurisdiction: EU/EEA — applies to any manufacturer, importer, or distributor placing a product with digital elements on the EU market, regardless of where the company is established
Record type / importance: regulation / license
Last verified: 2026-09-30

What it is

The EU's product-security law for connected products: mandatory cybersecurity requirements across the lifecycle of products with digital elements (PDEs) — any hardware or software with a direct or indirect network connection, including standalone software, mobile apps, and embedded firmware. It is the first regulation to make secure-by-design, vulnerability handling, and CE cybersecurity marking legally binding for software placed on the EU market. For software engineers, it converts practices like SBOMs, coordinated disclosure, and secure defaults from "good hygiene" into legal duties with product-withdrawal consequences.

Scope: who/what it applies to, triggers, thresholds

Products with digital elements: essentially all commercial software and connected hardware sold in the EU — from IoT devices to desktop applications to SaaS-adjacent downloadable products. Open-source software developed or supplied outside a commercial activity is excluded; commercial stewardship of OSS (foundations, companies monetizing support) carries lighter, tailored duties.
Roles: manufacturers (primary duty-bearer), importers, distributors — each with defined obligations; a U.S. vendor selling into the EU is a manufacturer for CRA purposes.
Product classes: default, Important Class I (e.g., password managers, VPNs, network management systems), Important Class II (e.g., operating systems, firewalls, industrial control components), and Critical (smart-card/secure-element type products) — higher classes require third-party conformity assessment by notified bodies rather than self-assessment.
Trigger: placing the product on the EU market. Each version placed on the market carries its own obligations.

Key requirements and compliance obligations

Essential cybersecurity requirements (Annex I): secure-by-design/default, no known exploitable vulnerabilities at placement, protection against unauthorized access, data confidentiality/integrity protections, minimized attack surfaces, logging, secure update mechanisms, and vulnerability disclosure policy.
Support period: security updates for at least 5 years (or the product's expected use time if demonstrably shorter — Commission 2026 guidance clarifies this is derived from realistic expected use, not the vendor's version-release policy). Substantial modifications do not automatically reset the clock.
SBOM: manufacturers must draw up a software bill of materials for each product and provide it to market-surveillance authorities on request; must also be able to provide it to certain professional users under confidentiality.
Vulnerability handling: documented processes to fix vulnerabilities without delay, distribute updates, and publish advisories.
Reporting (IN FORCE since Sept 11, 2026): notify actively exploited vulnerabilities within 24 hours and severe incidents within 72 hours through ENISA's single reporting platform. This is the operationally binding date most vendors underestimated — reporting duties apply even while full product-compliance programs are still being built.
Conformity assessment and CE marking: EU declaration of conformity, technical documentation, and the extended CE mark for full application (Dec 2027).
Penalties: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for essential-requirement breaches; market-surveillance authorities can order withdrawal or recall.

Version/edition status and LIVE changes (verified 2026-09-30)

Entered into force December 10, 2024; staggered application:
- Sept 11, 2026 — reporting obligations active NOW (Art. 14: exploited-vulnerability notification, incident reporting via ENISA portal). If you ship PDEs to the EU, an internal detection/triage/notification process should already exist.
- Dec 11, 2026 — notified-body obligations.
- Dec 11, 2027 — full application: essential requirements, SBOM, conformity assessment, extended CE marking.
Live 2026 context: Commission guidance (>80 pages, 2026) clarified support-period determination and substantial-modification rules — procurement teams are now testing vendor support-period declarations against it. No deferral has been announced; unlike the AI Act, the CRA timeline has held.
Software-engineering impact: SBOM generation in CI/CD, vulnerability-response SLAs aligned to 24h/72h clocks, and evidence retention for the technical file are the three capabilities to build before Dec 2027.

CISSP (software-cert-010): Software Development Security and Security Engineering domains map directly onto Annex I essential requirements.
AWS Solutions Architect Professional (software-cert-001), AWS DevOps Engineer Professional (software-cert-002), CKA (software-cert-007): secure-architecture and CI/CD content; none is CRA-specific. CRA conformity-assessment competence sits with notified bodies, not engineer credentials.

Honest flags

Penalty figures and the ENISA-portal mechanics are well-corroborated across 2026 guidance. The "no deferral" status reflects the absence of any announced change as of Sept 30, 2026 — monitor Commission communications, since AI Act deferral precedent shows timelines can move.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

EU Cyber Resilience Act (Regulation (EU) 2024/2847)