EU – Cyber Resilience Act: Council Adopts New Law on Security Requirements for Digital Products

Adherent (formerly Compliance & Risks). Cybersecurity lock graphic - concept for Cyber Resilience Act

This blog was originally posted on 22nd October, 2024. Further regulatory developments may have occurred after publication. To keep up-to-date with the latest compliance news, sign up to our newsletter.

AUTHORED BY MICHELLE WALSH, SENIOR LEGAL TEAM LEADER, COMPLIANCE & RISKS

Introduction

On 24 October 2024, the EU Council together with the EU Parliament adopted EU Regulation 2024/2847 on cybersecurity requirements for products with digital elements (known as the Cyber Resilience Act (CRA)).

It sets essential cybersecurity requirements, ensuring that products with digital components, for example ‘Internet of Things’ (IoT) products, are safe.

Key Elements of the Regulation

The law introduces harmonised EU-wide cybersecurity requirements for the design, development and production of products with digital elements.

A product with digital elements is defined as “a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately” (Article 3(1)).

The rules apply to products with digital elements, except for those covered by the following regulations:

Medical devices, covered by Regulation (EU) 2017/745 and Regulation (EU) 2017/746
Cars, covered by Regulation (EU) 2019/2144
Aeronautical products, covered by Regulation (EU) 2018/1139

Mandatory obligations are set for economic operators placing these products on the market, including manufacturers, importers, authorised representatives, and distributors.

Manufacturers must ensure that a product with digital elements has been designed, developed and produced in accordance with the essential cybersecurity requirements before it is placed on the market.
Article 13(2) requires manufacturers to undertake a cybersecurity risk assessment that takes into account the planning, design, development, production, delivery and maintenance phases of the product.
From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents that have an impact on the security of the product through the CRA Single Reporting Platform (SRP). The SRP is the online tool developed, operated and maintained by ENISA.
There are also conformity assessment procedures, technical documentation, declaration of conformity and CE marking requirements.

Key Dates

10 December 2024: the CRA entered into force.
11 June 2026: Chapter IV. EU Member States must designate a notifying authority and comply with the notified body requirements.
11 September 2026: vulnerability and severe-incident reporting obligations through the CRA SRP apply.
11 December 2027: full application of the CRA.

Frequently Asked Questions

What is the EU Cyber Resilience Act?

The EU Cyber Resilience Act is Regulation (EU) 2024/2847. It sets cybersecurity requirements for hardware and software products with digital elements made available on the EU market, including components sold separately. Manufacturers must build cybersecurity into planning, design, development, production, and phases of the product. They must also complete the correct conformity assessment procedure before placing a product on the market. The regulation entered into force on December 10, 2024, with obligations phased in after that date.

Which products fall within the scope of the EU Cyber Resilience Act?

The CRA covers products with digital elements that connect directly or indirectly to a device or network. This includes hardware, software, and separately marketed components made available through commercial activity in the EU. Specific products with digital elements are excluded. This applies to medical devices, cars and aeronautical products covered in specific regulations.

When do the EU Cyber Resilience Act requirements apply?

The CRA entered into force on December 10, 2024. Vulnerability and severe-incident reporting obligations apply from September 11, 2026. The full CRA applies from 11 December 2027. Manufacturers must meet the essential cybersecurity requirements in Annex I for their products. The provisions on market surveillance and enforcement, and the other provisions in the CRA, apply from this date. This phased timeline means that incident reporting processes must operate before the main compliance date.

What must manufacturers do first to prepare for CRA compliance?

Start with a cybersecurity risk assessment for each product with digital elements. The assessment informs how the manufacturer applies the essential cybersecurity requirements during planning, design, development, production, delivery, and maintenance. Manufacturers then prepare technical documentation, complete the applicable conformity procedure, issue an EU declaration of conformity, affix the CE marking, and establish processes to handle vulnerabilities throughout that period.

What are the Cyber Resilience Act reporting duties?

From September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents that affect product security. An early warning is due within 24 hours, followed by a full notification within 72 hours. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective measure becomes available.

For a severe incident, the final report is due within one month after submission of the 72-hour incident notification. Reports go through the CRA Single Reporting Platform.

What penalties can authorities impose under the Cyber Resilience Act?

For breaches of essential cybersecurity requirements or manufacturer and reporting duties, authorities can impose administrative fines up to EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher. Other types of infringement have different maximum penalties. EU Member States enforce the applicable penalty rules. An organisation’s exposure depends on the product, its operator role, the breached obligation, and the circumstances of the case.

Sources

Stay Ahead Of Regulatory Changes Like the Cyber Resilience Act

Want to stay ahead of regulatory developments like the EU’s Cyber Resilience Act?

Accelerate your ability to achieve, maintain & expand market access for all products in global markets with C2P – Your key to unlocking market access, trusted by more than 300 of the world’s leading brands.
C2P is an enterprise SaaS platform providing everything you need in one place to achieve your business objectives by proving compliance in over 195 countries.

C2P is purpose-built to be tailored to your specific needs with comprehensive capabilities that enable enterprise-wide management of regulations, standards, requirements and evidence.
Add-on packages help accelerate market access through use-case-specific solutions, global regulatory content, a global team of subject matter experts and professional services.

Accelerate time-to-market for products
Reduce non-compliance risks that impact your ability to meet business goals and cause reputational damage
Enable business continuity by digitizing your compliance process and building corporate memory
Improve efficiency and enable your team to focus on business critical initiatives rather than manual tasks
Save time with access to Compliance & Risks’ extensive Knowledge Partner network