Cyber Resilience Act (CRA)
Also known as: CRA, EU Cyber Resilience Act, Regulation (EU) 2024/2847, cybersecurity CE marking
The Cyber Resilience Act (CRA) is the EU regulation that makes manufacturers responsible for the cybersecurity of products with digital elements, including smart home devices, apps, and software, throughout their life cycle.
While the EU already required CE marking for product safety, the CRA extends that idea to security: no CE mark without secure design, vulnerability handling, and security updates. It's the first broad law of its kind.
Cyber Resilience Act (CRA), explained at three levels
At home
Think of the CRA as a seatbelt rule for connected products. Just as cars must meet safety standards before sale, smart doorbells, baby monitors, apps, and other products with software must meet cybersecurity standards before they can carry the CE mark in the EU. Manufacturers must also keep fixing security flaws for a stated support period, so the product stays safe after you buy it.
At work
The CRA is an EU regulation that sets cybersecurity requirements for products with digital elements, meaning hardware and software that connects to a device or network. Manufacturers must design products securely, handle vulnerabilities, provide security updates, and report actively exploited flaws. Importers and distributors have checking duties. Businesses care because, from December 2027, products that don't comply cannot be sold in the EU.
At home
Under the CRA, manufacturers must set a support period, the time they'll deliver security updates, based on how long the product is expected to be used, and generally at least five years. That period must be shown at the time of purchase. Security updates should be free and, where feasible, separate from feature updates, and products should install them automatically by default, with a way for you to opt out.
At work
The CRA works through conformity assessment, like other CE-marked products. Most products can be self-assessed against essential requirements such as secure default settings, protection against unauthorized access, data minimization, and a software bill of materials. 'Important' products, such as password managers, VPNs, routers, and operating systems, need harmonized standards or third-party assessment, and 'critical' products, such as smartcards and smart meter gateways, may need European cybersecurity certification.
At home
Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through a single EU reporting platform run by ENISA, the EU's cybersecurity agency. They send an early warning within 24 hours, a fuller notification within 72 hours, and a final report later. In my opinion, that rule could change industry culture, because quietly patching a known flaw and hoping nobody notices becomes a legal risk.
At work
The CRA covers hardware and software placed on the EU market, but excludes products governed by sector rules, such as medical devices, cars, and aviation. Penalties for breaching essential requirements reach €15 million or 2.5% of global turnover. Open-source software made outside commercial activity is excluded, while open-source stewards that support commercial use have lighter duties. Reporting has applied since September 2026 and full requirements apply from December 11, 2027, so SBOMs and vulnerability handling now carry legal weight.
Real-world examples
At home
Carlos was shopping for a smart thermostat in Spain and compared two models. One listed a security update period of five years and the other offered eight. Because the CRA will require support periods to be disclosed from December 2027, both makers had started listing them, so he could make an informed choice.
At work
Aisha is the product security lead at a Canadian company that sells home security cameras in Europe. Preparing for the CRA, her team built an SBOM for each product, set up a vulnerability disclosure program, and created a process to meet the 24-hour exploited-vulnerability reporting rule from September 2026.
Common confusions
- The CRA only applies to EU companies. — It applies to products sold on the EU market, regardless of where the manufacturer is based.
- All open-source developers will be liable. — Non-commercial open-source development is largely excluded, and open-source stewards have a lighter set of obligations.
- The CRA is already fully in effect. — Reporting obligations started on September 11, 2026, but most requirements apply only from December 11, 2027.
For analysts
The CRA turns security updates into a product commitment you can be held to. I'd involve product management, not just engineering, because promising a support period affects pricing, hardware choices, and the business model for older products.
History & origin
The European Commission proposed the CRA in September 2022, citing billions in annual damage from cyberattacks and insecure connected products. Debates over open-source software were intense: developers warned that the original text could make volunteers liable for code they shared freely. The final law, which introduced a lighter regime for 'open-source software stewards,' entered into force on December 10, 2024. Manufacturers must report actively exploited vulnerabilities and severe incidents from September 11, 2026, and the main obligations apply from December 11, 2027. In my view, the CRA is overdue. For decades, software companies have shipped insecure products with few consequences, and the cost has landed on customers.