Cyber Resilience Act (CRA)
CRA · Regulation (EU) 2024/2847 · products with digital elements · CE marking · règlement sur la cyberrésilience
The EU regulation that sets cybersecurity requirements for all hardware and software products with digital elements sold in the EU, from design to the end of their support period.
In practice
In force since 10 December 2024, the CRA applies in stages. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’s single reporting platform: early warning within 24 hours, notification within 72 hours, final report within 14 days of a fix being available (one month for an incident). From 11 December 2027, all obligations apply, with CE marking: products with no known exploitable vulnerability, secure by default, updated throughout the support period and documented with an SBOM. Pure SaaS services generally fall under NIS2, not the CRA. Fines can reach €15 million or 2.5% of worldwide turnover.
Fictional case: on 20 September 2026, a French maker of connected cameras learns that a firmware flaw is being used to recruit its cameras into a botnet. It sends an early warning within 24 hours through ENISA’s platform, a full notification within 72 hours, then its final report within 14 days of releasing the fix.
