The Cyber Resilience Act, in plain language.
The Cyber Resilience Act is an EU regulation that makes cybersecurity a legal requirement for products with digital elements. It applies to software, and to hardware that processes, stores or transmits digital data, when the product’s intended or reasonably foreseeable use includes a data connection to a device or network and it is made available on the EU market, unless an exclusion applies (Articles 2 and 3).
What it requires
Products must be secure by design, ship free of known exploitable vulnerabilities, and receive security updates over a defined support period. Manufacturers must run a process for handling and reporting vulnerabilities, and keep technical documentation, which includes a software bill of materials. Compliance is shown through a conformity assessment. Products outside the important and critical categories may be self-assessed under internal control, with no notified body; by drawing up the EU declaration of conformity, the manufacturer takes responsibility for compliance (Article 28(4)). Important and critical products face stricter routes, which involve a third party unless an important product of class I fully applies harmonised standards, common specifications or a certification scheme (Article 32). The product then carries the CE marking.
The dates that matter
Products placed on the market from 11 December 2027 must comply. Products placed on the market before it are caught only if they are substantially modified afterwards, except for the reporting duty, which covers them as well (Article 69(2) and (3)). Fines can reach 15 million euro or 2.5 per cent of total worldwide annual turnover for the essential requirements and Articles 13 and 14, 10 million or 2 per cent for the obligations listed in Article 64(3), and 5 million or 1 per cent for supplying incorrect, incomplete or misleading information, whichever is higher in each case.
Who has to act
Manufacturers of connected products. The obligations that carry the work sit with the manufacturer: building to the essential requirements, running vulnerability handling, and keeping the technical documentation. Importers and distributors have duties of their own, and selling a product under your own name or trademark makes you a manufacturer (Article 21).
Five questions on the CRA
Answer five questions about your product and see which articles of the Regulation your answers relate to. Your answers are never stored or sent.
If you conclude that the CRA applies, a readiness assessment reviews the technical side. Tell us about your product.
Your role: four questions to work through
The CRA puts most of the work on the manufacturer, but importers and distributors have duties of their own. These questions follow the definitions in Article 3 and Articles 21 and 22. Which role is yours is for you or your lawyer to conclude.
- Do you develop or manufacture the product, or have it designed, developed or manufactured, and market it under your own name or trademark? Article 3, point (13) defines the manufacturer this way, whether the product is supplied for payment, monetisation or free of charge.
- Are you established in the EU and placing on the market a product that bears the name or trademark of someone established outside the EU? Article 3, point (16) defines the importer this way. Article 19 sets out its duties.
- Do you make the product available on the EU market without affecting its properties, as someone other than the manufacturer or the importer? Article 3, point (17) defines the distributor this way. Article 20 sets out its duties.
- Do you place a product on the market under your own name or trademark, or substantially modify a product that is already on the market? Under Article 21, an importer or distributor that does either is considered a manufacturer, and Articles 13 and 14 apply to it. Under Article 22, anyone else who substantially modifies a product and makes it available on the market is considered a manufacturer, and Articles 13 and 14 apply for the part of the product the modification affects, or for the entire product if it has an impact on the product's cybersecurity as a whole. Article 3, point (30) defines a substantial modification.
Important and critical product categories
The category of a product decides which conformity assessment routes are open to its manufacturer. A product is an important product when it has the core functionality of a category in Annex III (Article 7(1)), and a critical product when it has the core functionality of a category in Annex IV (Article 8(1)). The technical description of each category is in Commission Implementing Regulation (EU) 2025/2392. Whether your product has the core functionality of one of these categories is for you or your lawyer to conclude.
Important products, class I (Annex III)
- Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers
- Standalone and embedded browsers
- Password managers
- Software that searches for, removes, or quarantines malicious software
- Products with digital elements with the function of virtual private network (VPN)
- Network management systems
- Security information and event management (SIEM) systems
- Boot managers
- Public key infrastructure and digital certificate issuance software
- Physical and virtual network interfaces
- Operating systems
- Routers, modems intended for the connection to the internet, and switches
- Microprocessors with security-related functionalities
- Microcontrollers with security-related functionalities
- Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
- Smart home general purpose virtual assistants
- Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
- Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features
- Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children
Important products, class II (Annex III)
- Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments
- Firewalls, intrusion detection and prevention systems
- Tamper-resistant microprocessors
- Tamper-resistant microcontrollers
Critical products (Annex IV)
- Hardware Devices with Security Boxes
- Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council and other devices for advanced security purposes, including for secure cryptoprocessing
- Smartcards or similar devices, including secure elements
Integrating a product that has the core functionality of an Annex III category does not in itself make the product it is integrated into subject to the conformity assessment procedures in Article 32(2) and (3) (Article 7(1)).
What the category changes (Article 32)
- None of these categories: internal control (module A), EU-type examination followed by internal production control (modules B and C), full quality assurance (module H), or a European cybersecurity certification scheme where available and applicable (Article 32(1)).
- Class I: the routes in Article 32(1), including internal control, only where the manufacturer has applied in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least "substantial"; otherwise modules B and C, or module H (Article 32(2)).
- Class II: modules B and C, module H, or a European cybersecurity certification scheme at assurance level at least "substantial", where available and applicable (Article 32(3)).
- Critical: a European cybersecurity certification scheme in accordance with Article 8(1); where its conditions are not met, any of the class II routes (Article 32(4)).
- Free and open-source software in an Annex III category: any of the routes in Article 32(1), provided the technical documentation is made public when the product is placed on the market (Article 32(5)).
Whatever the route, once conformity has been demonstrated the manufacturer draws up the EU declaration of conformity and affixes the CE marking (Article 13(12)).
Official sources
- Regulation (EU) 2024/2847 on EUR-Lex
- Commission Implementing Regulation (EU) 2025/2392: the technical descriptions of the important and critical categories
- The Commission's Cyber Resilience Act page
- The Commission's guidance of 27 July 2026
General information on the Regulation, not legal advice.