EU Cyber Resilience Act (CRA) Is Here! Connected Products Without Cybersecurity May Lose the EU Market

Bottom line: from September 2026, the vulnerability reporting obligation of the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) takes effect; it becomes fully mandatory on 11 December 2027. For any product with a "digital element" (connected, with software/firmware) that wants to enter the EU market, cybersecurity is no longer optional — it's a hard gate just like CE.

Many people think "I've done CE, that's enough" — wrong. CRA is a standalone regulation that elevates cybersecurity to the same level as functional safety. Get it wrong and you may not obtain the CE mark, be shut out of the EU market, and face fines up to €15 million or 2.5% of global annual turnover.

This article breaks down for you: what CRA governs, which category your product falls into, what you actually need to do, and where you're most likely to trip up.

1. What is CRA? Why is it so important?

CRA = the EU Cyber Resilience Act, Regulation (EU) 2024/2847.

• In force on 2024-12-10;
• Fully mandatory on 2027-12-11;
• It governs all Products with Digital Elements (PDEs) — hardware and software products that can connect directly or indirectly to a network, or process/store/transmit digital data.

In one sentence: it's "the CE mark for digital products". Just as CE governs safety, CRA requires manufacturers to consider cybersecurity across the product's entire lifecycle (design → development → production → end of life).

2. Which products are governed? (First judge if you're "hit")

Basic principle: as long as a product can connect to a network or has digital interaction and carries software/firmware, it's most likely governed. Common examples: Exceptions: a few already covered by strict cybersecurity regulations can be exempt (some aviation equipment, certain automotive parts). But most digital products can't escape.

3. Which category is your product? (Determines how much effort)

CRA divides products into Default / Important (Class I, Class II) / Critical, classified by risk:

4. CRA's core requirements (two main threads)

① Product design security (Annex I Part I)

• Put on the market with no known vulnerabilities
• Secure default configuration (must change the initial password, close unnecessary ports at the factory)
• Support security updates (free, timely)
• Unauthorized-access protection (authentication, permission management)
• Data protection (encryption at rest/in transit), data minimization
• Minimize attack surface (no hidden backdoors, no outdated dependency libraries)

② Vulnerability management (Annex I Part II)

• SBOM software bill of materials (machine-readable list of components/open-source libraries)
• Timely vulnerability fixes, periodic security testing
• Public disclosure of fixed vulnerabilities, coordinated vulnerability disclosure (CVD)
• A single point of contact for vulnerability reporting

5. Key timeline: What should you do when?

6. Manufacturer obligations & fines

Core obligations:

• Before launch + ongoing cybersecurity risk assessments
• Support period ≥5 years, security updates ≥10 years
• Keep technical documentation (Annex VII) for 10 years
• Issue a CRA Declaration of Conformity (EU DoC) + CE mark
• Report vulnerabilities/incidents to ENISA + CSIRT
• Provide user security information (Annex II)

Fines (apply to manufacturers, importers and distributors):

7. OEM / ODM special warning (must-read for factories)

• CRA's "manufacturer" = the brand owner (the party placing the product on the EU market), not the contract manufacturer.
• But the brand owner will pass CRA security requirements down to the factory through the contract.
• Factories should prepare: firmware source code / third-party component list (SBOM) / security test reports / vulnerability management process.
• Biggest risk: the brand owner suddenly asks for CRA materials, and the factory can't produce them → loses the order.

8. Pitfalls that sink you the moment you hit them

• Thinking CE is enough: ❌ CRA has its own requirements — cybersecurity and CE safety are two separate lines, you need both.
• Default class also going to a third party: ❌ default products go through Module A self-assessment — paying for testing is wasted money.
• Ignoring the 2026-09 vulnerability reporting: ❌ from 2026-09-11 vulnerabilities must be reported within the prescribed time limits; no process = non-compliant.
• Not preparing an SBOM: ❌ the software bill of materials is a core document, and many factories can't produce it.
• Factory-default passwords/open ports: ❌ CRA requires a secure default configuration — change the initial password and close unnecessary ports at the factory.
• Thinking it's only the brand owner's problem: ❌ contract manufacturers carry responsibility and lose orders too.

9. Your 5-step checklist right now

• Determine your class: is my product Default / Important / Critical? That determines whether a third party is needed.
• Do a security assessment: run cybersecurity risk assessments both before and after launch.
• Build a vulnerability management process: receive → analyze → fix → disclose, with a single point of contact.
• Prepare SBOM + technical documentation: software bill of materials, security tests, support-period documentation, kept for 10 years.
• Verify the secure default configuration: change the initial password, close ports, enable encryption — don't go to market "naked".

Final thoughts

CRA is not "one more certificate" — it's writing cybersecurity into the mandatory rules of the product lifecycle. For companies exporting connected products to the EU, this is another unavoidable gate after GDPR and CE. Truly smart people are already assessing their class and preparing the SBOM; the passive ones only learn when the EU market surveillance authority comes knocking.

As an export certification consultancy, we work every day helping clients sort out these hard gates, complete them, and clear customs smoothly.

If you make connected/software-bearing products and want to export to the EU, send me your product type and I'll do a free "CRA compliance assessment" for you — judge which class your product falls into, what to do, how long it takes, and which step is most likely to stall.

▍Have questions about the content? Leave a comment or DM me, note "CRA"

▍One-line value proposition: We help you get export certification done and clear customs smoothly.

CertFastLine Puhuazhike | Export Certification & Testing & Management Systems Consulting Statement: this article is a compliance reference for general information, not legal advice; specifics are subject to the EU's latest official texts, harmonized standards and the requirements of the competent authorities. Because CRA phases in, specifics depend on your product category and sale timing — we'll keep tracking updates.