From 11 September, the first obligations under the Cyber Resilience Act (CRA) will become applicable to manufacturers of products with digital elements. In the event of actively exploited vulnerabilities or severe incidents, the initial notification must be submitted within 24 hours. The penalties provided for by the Regulation may amount to up to EUR 15 million or, for undertakings, 2.5% of total worldwide annual turnover.
The CRA applies not only to undertakings that physically manufacture hardware products, but also to those that develop, or have developed, software and other digital products marketed under their own name or trademark. Its scope may therefore include, for example, software houses, manufacturers of connected and IoT devices, applications and software platforms, firmware, digital components, and machinery in which software constitutes a functional component.
The first obligation to become applicable is that set out in Article 14 of Regulation (EU) 2024/2847. In the event of an actively exploited vulnerability, the manufacturer must submit an initial notification within 24 hours and proceed with the subsequent notifications required by the Regulation. Specific reporting obligations also apply to severe incidents affecting product security. Notifications will be submitted through the Single Reporting Platform (SRP) established by ENISA.
More generally, the CRA introduces a European framework of mandatory cybersecurity requirements for products with digital elements. The Regulation will become fully applicable on 11 December 2027, when the requirements relating to secure design, vulnerability management throughout the product lifecycle, technical documentation, conformity assessment and CE marking will also become fully operational.
For undertakings concerned, the first step is therefore to identify the products falling within the scope of the CRA and determine the role performed in relation to each of them, followed by a review of existing processes and documentation and of any measures that may be required.
In view of 11 September, particular urgency should be given to establishing an internal process for managing and reporting vulnerabilities and incidents, with clearly defined responsibilities and information flows among IT, cybersecurity, legal and management functions.
Compliance with the CRA should also be coordinated, where applicable, with other European obligations relating to NIS2, the Data Act, the AI Act and personal data protection, avoiding duplication and leveraging processes and safeguards already adopted by the organisation.
We remain available to assess the applicability of the Cyber Resilience Act to your organisation’s products and to define the relevant compliance pathway.
