Software manufacturers
If your organisation makes a software product available on the EU market, it is sensible to assess the CRA early and make release, support and vulnerability-handling evidence easier to retrieve.
CRA Evidence Pilot
What is the Cyber Resilience Act?
A factual introduction to the EU Cyber Resilience Act, its timeline and the software teams that should pay attention.
The regulation in context
A European cybersecurity regulation for products with digital elements.
The Cyber Resilience Act is Regulation (EU) 2024/2847. It introduces horizontal cybersecurity requirements for hardware and software products with digital elements made available on the EU market.
The regulation is broad. Whether it applies to a particular product depends on the facts, including the product, its intended use and how it is made available. This page is a practical introduction, not legal advice or a scope determination.
Read the official EU CRA overviewWho should pay attention
Teams that make digital products available in the EU.
The examples below are practical starting points. They do not replace an assessment of your own product or legal responsibilities.
Product and engineering teams
Teams that release regularly need a repeatable way to connect source, dependencies, observations and follow-up decisions to the exact release they concern.
Open-source software stewards
The CRA also contains specific provisions for qualifying open-source software stewards. The official EU guidance explains the distinction and the related responsibilities.
CRA implementation timeline
The key dates to put on the operating calendar.
The dates below summarise the official EU implementation timeline. Regulations and guidance can evolve, so use the linked EU sources for the current authoritative detail.
-
10 December 2024
The CRA entered into force.
Regulation (EU) 2024/2847 entered into force, beginning the implementation period.
-
11 June 2026
Conformity-assessment body provisions began to apply.
The CRA provisions concerning notification of conformity-assessment bodies started to apply.
-
11 September 2026
Reporting obligations began to apply.
Manufacturers must report actively exploited vulnerabilities and severe incidents through the CRA reporting process.
-
11 December 2027
The main CRA obligations apply.
The regulation becomes broadly applicable, subject to its scope, transitional rules and product-specific circumstances.
What this means in practice
Start with an exact release and the facts your team already has.
The practical challenge is not just finding vulnerabilities. It is retaining the release context, the evidence, the decisions and the follow-up in a record that can be revisited without reconstructing history later.
CRA Evidence Pilot
One product. One real release. Two weeks.
A bounded way to see whether your existing technical process can produce a dependable release evidence record.
Request a pilot conversationOne product. One real release. Two weeks.
Request a pilot conversation