Cyber Resilience Act (CRA)
Also known as: CRA, EU Cyber Resilience Act, Regulation (EU) 2024/2847, cybersecurity CE marking
The Cyber Resilience Act (CRA) is the EU regulation that makes manufacturers responsible for the cybersecurity of products with digital elements, including smart home devices, apps, and software, throughout their life cycle.
While the EU already required CE marking for product safety, the CRA extends that idea to security: no CE mark without secure design, vulnerability handling, and security updates. It's the first broad law of its kind.
Cyber Resilience Act (CRA), explained at three levels
At home
When you buy a smart doorbell or a baby monitor in the EU, the Cyber Resilience Act means the manufacturer has to make it reasonably secure and provide security updates for a set period. It's like a safety rule for electrical appliances, but for hacking.
At work
If your company makes or sells software or connected devices in the EU, the CRA will require you to design them securely, fix vulnerabilities, provide updates, and report actively exploited vulnerabilities. Products will need CE marking for cybersecurity.
At home
Manufacturers must tell buyers how long a product will get security updates, and that period generally should be at least five years unless the product is expected to be used for less. That should make it easier to compare products on how long they'll stay safe.
At work
Requirements include secure-by-default configurations, protection against unauthorized access, data minimization, vulnerability handling processes, a software bill of materials (SBOM), and coordinated vulnerability disclosure. 'Important' and 'critical' product categories, such as password managers, firewalls, and certain operating systems, face stricter conformity assessments.
At home
The CRA requires manufacturers to report actively exploited vulnerabilities to authorities and ENISA, the EU's cybersecurity agency, within tight timelines, starting with an early warning within 24 hours. In my opinion, that rule could change industry culture, because quietly patching a known flaw and hoping nobody notices becomes a legal risk.
At work
The CRA covers hardware and software sold in the EU market, with exclusions for products covered by sector laws (such as medical devices and cars). Penalties for breaching essential requirements can reach €15 million or 2.5% of global turnover. Open-source projects developed outside commercial activity are largely excluded, while open-source stewards have lighter duties. For vendors, SBOMs and vulnerability management become product features with legal weight.
Real-world examples
At home
Carlos was shopping for a smart thermostat in Spain and compared two models. One listed a security update period of five years and the other offered eight. Thanks to the CRA's labelling requirement, he could make an informed choice.
At work
Aisha is the product security lead at a Canadian company that sells home security cameras in Europe. Preparing for the CRA, her team built an SBOM for each product, set up a vulnerability disclosure program, and created a process to meet the 24-hour exploited-vulnerability reporting rule from September 2026.
Common confusions
- The CRA only applies to EU companies. — It applies to products sold on the EU market, regardless of where the manufacturer is based.
- All open-source developers will be liable. — Non-commercial open-source development is largely excluded, and open-source stewards have a lighter set of obligations.
- The CRA is already fully in effect. — Reporting obligations start in September 2026, and most requirements apply from December 2027.
For analysts
The CRA turns security updates into a product commitment you can be held to. I'd involve product management, not just engineering, because promising a support period affects pricing, hardware choices, and the business model for older products.
History & origin
The European Commission proposed the CRA in September 2022, citing billions in annual damage from cyberattacks and insecure connected products. Debates over open-source software were intense: developers warned that the original text could make volunteers liable for code they shared freely. The final law, which introduced a lighter regime for 'open-source software stewards,' entered into force on December 10, 2024. Manufacturers must report actively exploited vulnerabilities and severe incidents from September 11, 2026, and the main obligations apply from December 11, 2027. In my view, the CRA is overdue. For decades, software companies have shipped insecure products with few consequences, and the cost has landed on customers.