The European Cyber Resilience Act (CRA) is a mandatory EU cybersecurity regulation for hardware, firmware and software products with digital elements. Aligned with the CE marking framework, it serves as an EU market access requirement.
On 11 September 2026, the mandatory vulnerability reporting obligation under the EU Cyber Resilience Act (CRA) enters into force.
Full enforcement of this regulation commences on 11 December 2027. All products with digital elements placed on the EU market after this date must comply with the full CRA obligations. Products already placed on the market prior to this date are exempt from CRA requirements.(save for vulnerability and incident notification obligations)
Important note:
“Placed on the market” is not the same as the production date. It refers to the time when the product is first distributed or sold within the EU. If a product is manufactured before 2027 but first placed on the EU market after December 2027, it is still considered a new product and must achieve full CRA compliance.
Key Points
1. Products without any digital elements or embedded software are outside the scope of the CRA.
2. Non-compliant products may be withdrawn from the EU market, and economic operators can face substantial fines up to 4% of global annual turnover.
3. Manufacturers, importers and EU authorised representatives bear respective compliance obligations under the CRA.
4. The incident notification obligation requires economic operators to notify relevant EU authorities within specified timeframes once exploitable cybersecurity vulnerabilities or security incidents are identified.