The Cyber Resilience Act, in plain words
The Cyber Resilience Act (CRA) sets security rules for products with software that are sold in the EU. These guides answer the questions small device makers ask most, with the article behind each answer.
11 September 2026
Reporting duties apply (Article 14), also for products already on the market.
11 December 2027
Everything else applies (Article 71(2)).
Not sure which class your product is in?
Take the free product-class checkGuides
What the Cyber Resilience Act asks of manufacturers
Every duty a device maker carries under the CRA, with the article it comes from and what it means for your team.
Cyber Resilience Act deadlines: what applies and when
Three dates matter. Two have already passed. Here is what each one means for a small device maker.
CRA reporting: what to send, to whom, and how fast
Article 14 has applied since 11 September 2026. Two kinds of event, three reports each, and a clock that starts when you find out.
SBOM: the parts list the Cyber Resilience Act asks for
An SBOM is a machine-readable list of what's inside your software. The CRA makes one mandatory. Here's what it must cover and which formats work.
The CRA support period: how long you must keep fixing
At least five years in most cases, with the end date shown at purchase. Here's how to set it and what it commits you to.
CRA technical documentation: the Annex VII file, point by point
Eight things the file must contain, when it must exist, and which parts only your team can write.
The EU declaration of conformity under the CRA
The one-page document you sign to say your product meets the CRA. What goes on it, when you can sign, and what signing commits you to.
CRA product classes: default, important and critical
Most connected products are in the default class and can be self-assessed. Some need an outside body. The full Annex III and IV lists, in plain words.
Cyber Resilience Act fines: the three tiers and how they're set
Up to €15 million or 2.5% of turnover at the top. What each tier covers, how authorities choose an amount, and where small firms get relief.
The Cyber Resilience Act for small companies
Small companies carry the same core duties as big ones. The law gives a few specific reliefs and some support. Here's what they are.
UK device makers: the PSTI regime and the EU Cyber Resilience Act
The CRA is EU law, but it applies to you the moment you sell into the EU. How it sits next to the UK's own product security law.
Facts checked against Regulation (EU) 2024/2847 on EUR-Lex.