Home › Law library › Cyber Resilience Act (CRA)
Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
Sourced · 13/14 facts confirmed by two sources. Last verified 10 October 2026
Next full re-check due: . Regulator news is checked monthly; changes are logged in the change log.
Cite this page: GlanceDesk Jurisdiction, “Cyber Resilience Act (CRA) (European Union)”, glancedeskjurisdiction.com/laws/eu-cra, last verified 10 October 2026.
European Union Cybersecurity
- Status
- In force since 10 Dec 2024; reporting obligations apply from 11 Sep 2026; main obligations from 11 Dec 2027.✓
- Who it applies to
- Manufacturers, importers and distributors of hardware and software products with digital elements placed on the EU market, wherever they are based (consumer IoT, apps, software, components).✓
- Size thresholds
- None — applies regardless of size; no fines on micro/small firms for missing the 24h early-warning deadline.✓
- Regulator
- National market surveillance authorities and CSIRTs; ENISA runs the Single Reporting Platform✓
- Breach or incident reporting
- Actively exploited vulnerabilities and severe incidents: early warning within 24h, notification within 72h; final report 14 days after a fix (vulnerabilities) or 1 month after notification (incidents). Via ENISA Single Reporting Platform.✓
- Local representative
- Non-EU manufacturers may appoint an EU authorised representative; importers must ensure compliance.✓
- Maximum penalty
- Up to EUR 15m or 2.5% of worldwide turnover (essential requirements, Arts 13-14); EUR 10m or 2% (other duties); EUR 5m or 1% (misleading info).
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do✓
- Report actively exploited vulnerabilities and severe incidents within 24h (from 11 Sep 2026).
- Register on ENISA's Single Reporting Platform and assign a reporting owner.
- Design products to meet Annex I security requirements by 11 Dec 2027.
- Define a support period and ship security updates throughout it.
- Keep an SBOM and run a coordinated vulnerability disclosure policy.
- Complete conformity assessment and CE marking before placing products on the market.
Recent changes
Reporting obligations went live 11 Sep 2026 with ENISA's Single Reporting Platform; Commission published implementation guidance on 27 Jul 2026; delegated act on delayed CSIRT sharing adopted 11 Dec 2025.✓
Sources
- Primary source: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting
- Second source: https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/cyber-resilience-act-reporting-obligations-apply-from-11-september-2026
- Regulator: National market surveillance authorities and CSIRTs; ENISA runs the Single Reporting Platform
Sources used for the independent check (10)
- https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation
- https://www.hlc.com/en/publications/eu-cyber-resilience-act-getting-ready-for-cra-compliance-in-2026
- https://digital-strategy.ec.europa.eu/en/policies/cra-summary
- https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/cyber-resilience-act-reporting-obligations-apply-from-11-september-2026
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847
- https://www.springlex.eu/en/packages/cra/cra-regulation/article-64/
- https://digital-strategy.ec.europa.eu/en/policies/cra-reporting
- https://www.springlex.eu/en/packages/cra/cra-regulation/annex-1/
- https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation
= confirmed by two independent sources, at least one official. How we verify
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@