Which products fall under the Cyber Resilience Act?

The CRA covers any product with digital elements placed on the EU market — connected hardware (IoT devices, routers, industrial controllers) and software (operating systems, browsers, SaaS components, libraries). Pure online services, open-source software not commercially supplied, and products already covered by sector regulation (medical devices, vehicles, civil aviation) are outside scope.

When does the CRA become enforceable?

The CRA entered into force on 10 December 2024. Reporting obligations for actively-exploited vulnerabilities and severe incidents apply from 11 September 2026, and the full set of essential requirements applies from 11 December 2027 to all products placed on the market thereafter.

What are the SBOM requirements under the CRA?

Manufacturers must produce a Software Bill of Materials covering at least the top-level dependencies of their product, in a machine-readable format. The SBOM must be kept up to date for the product's support period and made available to market surveillance authorities on request.

How long must vendors provide security updates?

The CRA mandates a support period that reflects the expected use of the product but is at least five years from the date the product is placed on the market. Updates addressing security vulnerabilities must be provided free of charge to users for that entire period.

How fast must vulnerabilities and incidents be reported?

An early warning to ENISA and the relevant national CSIRT is required within 24 hours of becoming aware of an actively-exploited vulnerability or severe incident, a full notification within 72 hours and a final report no later than 14 days after a fix becomes available.

What are the penalties for CRA non-compliance?

Failure to meet essential cybersecurity requirements can be sanctioned with administrative fines up to €15 million or 2.5% of global annual turnover, whichever is higher. Authorities may also order product recalls or withdraw products from the EU market.

EU Compliance Platform — v.2026

The European platform for measurable compliance posture.

LEXNOMIA turns the static letter of EU regulation — GDPR, NIS2, DORA, EU AI Act, ISO 27001, CRA, DSA — into auditor-grade readiness assessments mid-market organisations can act on in minutes.

Frameworks covered

GDPR — General Data Protection Regulation
NIS2 — Network & Information Security Directive
DORA — Digital Operational Resilience Act
EU AI Act — Regulation (EU) 2024/1689
ISO/IEC 27001:2022 — Information Security Management
Cyber Resilience Act
Digital Services Act

Pricing

Free trial · Starter €99/mo · Professional €299/mo · Enterprise €499/mo