CRA 101: What the EU's Cyber Resilience Act Actually Requires

Connected products have long been one of attackers’ favorite ways in, and the rules governing their security have been, charitably, inconsistent. The European Union’s Cyber Resilience Act is designed to change that by establishing a single set of cybersecurity requirements for hardware and software available across Europe. If your organization builds, imports, or distributes those products, here’s what the CRA means for you, and why it matters even if you’re outside the EU.

What is the Cyber Resilience Act (CRA)?

The Cyber Resilience Act is the EU’s first cybersecurity law that applies across industries to products with digital elements. The law covers hardware, firmware, operating systems, applications, and even software components like libraries. Before the CRA, product security rules were a patchwork of national and sector-specific requirements. The result of that was seen through inconsistent security updates, widespread vulnerabilities, and little information to help buyers judge how secure a product was. Buyers were largely left to take the vendor’s word for it.

The CRA’s overall goal is twofold. First, it aims to get hardware and software onto the market with fewer vulnerabilities, with manufacturers responsible for security throughout a product’s life. Second, it aims to give buyers the information they need to factor cybersecurity into what they choose and how they use it.

Who Does the CRA Apply To?

The CRA applies to anyone who brings a digital product to the EU market, and the responsibilities depend on your role:

• Manufacturers design, build, or market products under their own name. They carry most of the obligations.
• Importers bring products made outside the EU into the EU market. They must check that the manufacturer has met CRA’s requirements, including conformity assessment, technical documentation, and CE marking.
• Distributors resell products already on the market. They must also confirm their products meet the requirements.
• Open-source stewards are organizations that support open-source projects intended for commercial use. They follow a lighter set of rules.

Roles can shift. An importer or distributor that sells a product under its own brand or substantially modifies one assumes the manufacturer's obligations.

Open-source software that isn’t sold or otherwise monetized falls outside the Act, so individual contributors and hobbyists aren’t affected.

What Does the CRA Require Manufacturers to Do?

Security can’t be an afterthought. The CRA makes manufacturers responsible for it at every stage of a product’s life, from the earliest design choices through years of updates.

In practice, that means:

• Security by design and by default, backed by a documented risk assessment.
• Ongoing vulnerability handling for the product’s full support period, which must be at least five years unless the product is expected to be in use for less time.
• Conformity assessment, with higher-risk products needing review by an independent third party before earning the CE mark, the label showing that a product meets EU requirements.
• Mandatory reporting of actively exploited vulnerabilities and severe incidents.

When Do CRA Reporting Obligations Start?

They already have. If that’s news to you, the clock is still running. Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents on a schedule that leaves little room for a long internal debate: an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report within 14 days of a corrective or mitigating measure being available for vulnerabilities, or within one month of the 72-hour notification for severe incidents. Reports go through a single EU platform, which routes them to national authorities and the European Union Agency for Cybersecurity (ENISA).

The stakes are real. Failing to meet these obligations can bring fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.

What Are the Key CRA Compliance Dates?

The CRA’s requirements are phasing in over four milestones:

• December 10, 2024: The CRA entered into force.
• June 11, 2026: Rules for conformity assessment bodies (the organizations that evaluate products) began to apply. EU member states must also have designated the authorities responsible for approving those bodies.
• September 11, 2026: Reporting obligations began.
• December 11, 2027: Full obligations apply, including conformity assessment and CE marking.

Older products don’t get a complete pass. Reporting obligations cover everything already on the EU market, while the other requirements apply only to products made available before December 11, 2027, only if they are significantly modified afterward.

The European Commission also published practical guidance to help manufacturers interpret the rules. It is not legally binding, but it shows how the Commission reads the act.

Does the CRA Apply to Companies Outside the EU?

Yes. Geography is not a loophole. The CRA applies to any product made available on the EU market, regardless of where it’s designed or built. Few manufacturers maintain separate “EU” and “rest of the world” product lines, so the CRA is likely to raise the bar globally, similar to how the General Data Protection Regulation (GDPR) did for data privacy.

How Does File Integrity Monitoring Support CRA Compliance?

Much to the dismay of product security and compliance teams, CRA compliance isn’t a one-time certification. This is something ongoing that needs to be demonstrated throughout a product’s support period. Continuous file integrity monitoring supports that by showing, in real time, whether a system’s files or configurations have drifted from a known-good baseline.

Want to see how it works? Our guide to file integrity monitoring explains how it detects unauthorized changes, supports compliance, and where CimTrak fits in. Download the File Integrity Monitoring Guide.

This is the first post in our series on the CRA. Next, we’ll look at the technical requirements in more detail.