EU Cyber Resilience Act: reporting since September 2026, CE rules from 2027

Scope and conformity assessment

The CRA applies to hardware and software products with digital elements made available on the EU market, including remote data processing solutions and components placed on the market separately, when their intended or reasonably foreseeable use includes a direct or indirect data connection. Products not supplied in a commercial activity are not covered, and some products covered by other EU legislation are excluded.

Most products can use self-assessment (internal control, module A). Important Class I products can self-assess only if harmonised standards, common specifications or a European cybersecurity certification scheme were applied; otherwise a notified body is needed. Important Class II and critical products need a third-party assessment or a certification scheme. Using harmonised standards gives a presumption of conformity.

Manufacturer obligations

• Carry out a cybersecurity risk assessment and meet the essential requirements in Annex I, including vulnerability handling during the support period.
• Exercise due diligence on integrated third-party components.
• Keep the technical documentation available to market surveillance authorities.
• Give identification and contact details and user information under Annex II, including the end date of the support period (month and year) at the time of purchase.
• Draw up the EU declaration of conformity and affix the CE marking before placing the product on the market.
• Report actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours, and a final report within 14 days after a fix is available (vulnerabilities) or within one month (severe incidents).

Importers, distributors and the timeline

Importers must check that the manufacturer has carried out the conformity assessment, that the technical documentation exists and that the product carries the CE marking, and must not place non-compliant products on the market. Distributors must check the CE marking and the manufacturer's and importer's information, including the support period. Both must tell the manufacturer about vulnerabilities and cooperate with the authorities. A manufacturer can appoint an authorised representative by written mandate.

The reporting obligations apply from 11 September 2026, also to products already on the market. The main provisions apply from 11 December 2027; products already on the market are covered only if they are substantially modified after that date. Existing EU type-examination certificates on cybersecurity expire on 11 June 2028 unless they lapse earlier. Penalties are set by each Member State, and micro and small enterprises may not be fined for missing the 24-hour deadline.