EU Cyber Resilience Act

Connected products must meet the Cyber Resilience Act by December 2027.

Penumbral Labs tests your product against the CRA essential requirements and hands you the evidence and a plan to act on.

Tell us about your product Are you in scope? Take the 5-minute check →

The deadline

11 Sep 2026

Vulnerability reporting duties began.

11 Dec 2027

Most obligations apply. Products placed on the market from then must comply.

15M € / 2.5%

Maximum penalty for the essential requirements, or 2.5 per cent of global turnover, whichever is higher.

The EU Cyber Resilience Act makes cybersecurity a legal condition for selling products with digital elements in the EU. From 11 December 2027, products placed on the EU market have to meet its essential cybersecurity requirements.

What we do

All services →

We get manufacturers ready. A fixed-scope readiness assessment reviews your product against the essential requirements. Hands-on testing proves what is actually exploitable. An ongoing retainer handles vulnerabilities and the reporting after launch. All delivered by an offensive-security specialist, not a checklist.

Readiness assessment

A fixed-scope review of your product against the CRA essential requirements, with our observations and a list of actions.

Hands-on testing

We attack the real product and prove what is actually exploitable, not just what a form says.

Ongoing support

We handle vulnerabilities and the reporting after launch, so nothing lapses once the first pass is done.

Why Penumbral Labs

Most compliance help is a questionnaire and a slide deck. We come at your product the way an attacker does, find the real weaknesses, and hand you a plan to fix them.

You get the rigour of an offensive security engagement without a large consultancy's price tag or timeline.

✓We test like an attacker, not a questionnaire.

✓Real vulnerability evidence, not a slide deck.

✓Offensive-security rigour without consultancy pricing or timelines.

The deadline is fixed. The sooner you know what your product needs, the calmer the road to 2027.

Tell us about your product and we will reply in writing within two working days.

Get in touch