The EU Cyber Resilience Act puts product makers on a 24-hour clock

Companies that sell smartwatches, baby monitors, business software, and other connected products in the European Union now have 24 hours to warn authorities after they learn that a vulnerability in one of those products is being actively exploited.

‍

The deadline comes from the EU Cyber Resilience Act (CRA), formally Regulation (EU) 2024/2847, the EU's first horizontal cybersecurity law for products with digital elements. Earlier EU cybersecurity laws such as NIS 2 and DORA focus on how organizations operate. The CRA regulates what they ship, placing responsibility for the security of hardware and software on the manufacturers, importers, and distributors that put those products on the EU market, wherever they are based.

‍

The CRA's Article 14 reporting obligations took effect on September 11, 2026, and the law's full set of requirements applies from December 11, 2027. Here's who the law covers, what it requires, and what preparation involves.

‍

What is the EU Cyber Resilience Act?

Regulation (EU) 2024/2847 entered into force December 10, 2024. The law covers products with digital elements and products whose intended or foreseeable use involves direct or indirect data connections to devices or networks. This includes hardware and software and extends across each product's entire lifecycle. 

‍

The definition is deliberately broad. It covers connected consumer devices such as baby monitors and smartwatches, business hardware, mobile and desktop apps, operating systems, and software libraries and components. There are exceptions, but by and large, the law spreads obligations across the supply chain.

‍

According to the European Commission, the law's primary purpose is to shift responsibility for security onto the companies that place products on the market, rather than leaving it to users.

‍

How is the CRA different from NIS 2 and DORA?

‍

The CRA regulates products, while NIS 2 and DORA regulate organizations and how they operate. NIS 2 sets cybersecurity rules for essential and important entities, and DORA does the same for financial firms, so a company can be in scope of all three for different reasons.

‍

Who does the CRA apply to?

The CRA applies to any company that places a covered product on the EU market, wherever it is based. Obligations fall on three roles in the supply chain:

‍

• Manufacturers carry the primary obligations: secure design, technical documentation, conformity assessment, and vulnerability handling.
• Importers can only place CRA-compliant products on the EU market, and they must verify that the manufacturer met its obligations before doing so.
• Distributors must act with due care, which means confirming that the CE marking and required documentation are present before they distribute a product.

‍

Some products and organizations are treated differently:

‍

• Products covered by sector rules: Article 2 excludes products already governed by sector-specific rules, such as medical devices, in-vitro diagnostic devices, motor vehicles, civil aviation, and marine equipment.
• Open source software stewards: Organizations that provide systematic and sustained support for open source software intended for commercial use, without placing a product on the market themselves, follow lighter rules under Article 24. Their reporting obligations begin on December 11, 2027.

‍

{{cta_withimage12="/cta-blocks"}}

‍

EU Cyber Resilience Act timeline: key dates

Cyber resilience act compliance has been phased in across four key dates.

‍

• December 10, 2024: CRA entered into force.
• June 11, 2026: Chapter IV of the CRA applies, meaning conformity assessment bodies can be notified ahead of full application.
• September 11, 2026: CRA Article 14 reporting obligations begin.
• December 11, 2027: The CRA's main obligations apply in full.

‍

What does the CRA require?

The CRA sets requirements across a product's full lifecycle. Manufacturers must build products that meet the essential cybersecurity requirements, handle vulnerabilities for as long as the product is supported, report actively exploited vulnerabilities and severe incidents under Article 14, and pass a conformity assessment before applying the CE marking.

‍

Essential cybersecurity requirements

Annex I of the CRA lists the security properties every covered product must have when it reaches the market. They include:

‍

• Secure by design: Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on the risks.
• Secure by default: Products must ship with a secure default configuration, including the ability to reset the product to that original state.
• No known exploitable vulnerabilities: Products cannot be placed on the market with known exploitable vulnerabilities.
• Access and data protection: Products must protect against unauthorized access and protect the confidentiality and integrity of the data they store, transmit, or process.
• Limited attack surface: Products must be designed to limit attack surfaces, including external interfaces.
• Security logging: Products must record and monitor relevant internal activity, such as access to or changes to data, services, or functions.

‍

Vulnerability handling and SBOM

The CRA treats security as ongoing work, not a one-time check at launch. Throughout the support period, manufacturers must:

‍

• Identify and document vulnerabilities: This includes maintaining a software bill of materials (SBOM), a machine-readable list of the product’s components that covers at least its top-level dependencies.
• Fix vulnerabilities without delay: Remediation includes providing security updates.
• Provide free security updates: Updates must be free of charge and come with advisory messages that tell users what action to take.
• Run a coordinated vulnerability disclosure policy: Manufacturers must put a policy in place and enforce it.
• Disclose fixed vulnerabilities: Once a security update is available, manufacturers must publicly share information about the vulnerabilities it fixes.

‍

Article 14 reporting

Article 14 reporting obligations have applied since September 11, 2026. Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's CRA Single Reporting Platform on a fixed timeline:

‍

• Early warning: Within 24 hours of becoming aware of the vulnerability or incident.
• Full notification: Within 72 hours.
• Final report: Within 14 days of a fix becoming available for an actively exploited vulnerability, or within one month of the notification for a severe incident.

‍

Manufacturers submit one notification to the CSIRT designated as coordinator, and unless exceptional circumstances apply, the information is made available to ENISA at the same time.

‍

Conformity assessment and CE marking

Before applying the CE marking, manufacturers must show through a conformity assessment that a product meets the CRA's requirements. The route depends on the product's category:

‍

• Default products: Most products fall here, and manufacturers can assess conformity themselves.
• Important products, class I: Self-assessment is allowed only if the manufacturer applied harmonized standards, common specifications, or a European cybersecurity certification scheme. Otherwise, a third-party assessment is required.
• Important products, class II: These require a notified body or a European cybersecurity certificate at an assurance level of at least “substantial.”
• Critical products: These may require mandatory European cybersecurity certification once the relevant delegated acts and certification schemes apply.

‍

Annex III of the CRA lists important products, and Annex IV lists critical products. Once the assessment is complete, the manufacturer draws up the EU declaration of conformity and affixes the CE marking.

‍

Support period and penalties

Manufacturers must set a support period that reflects how long each product is expected to be in use, generally at least five years. A shorter period is allowed only when the product's expected use time is shorter.

‍

Breaching the essential requirements or the Article 13 and 14 obligations can bring fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.

‍

How should companies prepare for the CRA?

Preparing for the CRA starts at the product level. Five steps can begin now, before the harmonized standards are final:

‍

1. Inventory which products are in scope. Companies need to identify every product with digital elements they place on the EU market.
2. Classify each product. Each product is default, important (class I or II), or critical, and that classification sets its conformity assessment route.
3. Set up a coordinated vulnerability disclosure process. Manufacturers need a workflow that can meet the 24-hour early warning and 72-hour notification deadlines. Only actively exploited vulnerabilities and severe incidents must be reported under Article 14.
4. Map software dependencies and produce an SBOM. The SBOM must document all top-level dependencies at a minimum, with indirect dependencies mapped where practical.
5. Track the harmonized standards. ETSI is developing standards that may support the CRA, but not every ETSI standard creates a CRA obligation. The ones to follow are those formally identified for CRA implementation.

‍

"Until you know which of your products are in scope and whether each is default, important, or critical, you can't determine your conformity route, your documentation burden, or even who in the organization owns the obligation," said Niya Raina, a GRC subject matter expert at Vanta.

‍

"Sequence the work by deadline rather than treating the CRA as a single 2027 event," Raina said. Because the reporting obligations are already in effect, she said, the vulnerability disclosure process is the immediate priority, and scoping, dependency mapping, and the SBOM are also safe to start now. Detailed control mapping should wait until the harmonized standards are final.

‍

What comes next for the CRA

The CRA's remaining obligations take effect on December 11, 2027, and some of the technical detail behind them is still being written. ETSI and other European standards bodies are finalizing the harmonized standards manufacturers will use to demonstrate conformity.

‍

The CRA also joins an already crowded EU rulebook. Many companies with products in scope are covered by NIS 2 as entities, and financial firms answer to DORA as well. Each of these laws expects security controls to be monitored and documented over time, which is the work continuous control monitoring and automated evidence collection are designed to support. Neither replaces the CRA's product-specific obligations, from SBOMs to CE marking.

‍

The stakes are significant. Breaching the essential requirements or the Article 13 and 14 obligations can bring fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.

‍

How Vanta helps you prepare for the CRA

Vanta is a compliance and trust management platform that automates the security monitoring and evidence collection behind frameworks like NIS 2, DORA, and ISO 27001. Vanta doesn't offer CRA framework support today, and because the harmonized standards aren't final, no CRA control mapping exists yet. What Vanta can do is help you build the foundations future CRA work will rely on, like continuous control monitoring and automated evidence collection, and automate the EU frameworks you may already be in scope for.

‍

Many organizations with products in CRA scope also fall under NIS 2. Vanta's NIS 2 product helps you meet those requirements with:

‍

• Centralized control management to track ownership, implementation, and real-time status of NIS 2 controls
• Vendor and supply chain risk management to identify, assess, and monitor third-party risk
• Issue management to track incidents, remediation tasks, and corrective actions
• Framework mapping that reuses NIS 2 evidence across ISO 27001, NIST CSF 2.0, and TISAX
• 400+ integrations that power continuous monitoring

‍

These capabilities help you prepare for the CRA, but they don't replace its product-specific requirements for documentation, vulnerability reporting, and conformity assessment.

‍

Schedule a custom demo to see how Vanta automates NIS 2 compliance while you prepare for the CRA.

‍

{{cta_simple30="/cta-blocks"}}

FAQs

Has the Cyber Resilience Act been passed?

Yes. Regulation (EU) 2024/2847 entered into force on December 10, 2024. Article 14 reporting obligations began on September 11, 2026, and the full set of requirements applies from December 11, 2027.

‍

What is the difference between NIS 2 and the CRA?

NIS 2 is entity-level: it regulates how organizations operate, requiring policies for supply chain security, vulnerability management, and cybersecurity awareness. The CRA is product-level: it regulates products with digital elements once they're placed on the EU market. A company can be in scope of both for different reasons.

‍

Does the CRA apply to open source?

Partly. Open source stewards, meaning legal persons who provide systematic and sustained support for open source software intended for commercial use without placing a product on the market themselves, fall under a lighter regime in Article 24 rather than full manufacturer obligations. Their reporting obligations under Article 24(3) begin on December 11, 2027, rather than with the Article 14 manufacturer reporting obligations that began on September 11, 2026.

‍

Does the CRA apply to non-EU companies?

Yes. The CRA applies to any company that places a covered product on the EU market, regardless of where it is based.

‍

‍A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.