Prepare your products for the Cyber Resilience Act
Last updated 30 September 2026. A summary, not legal advice. Always check the official text for your case.
Every product with digital elements sold in the EU must be secure by design. Since 11 September 2026 the manufacturer must report actively exploited vulnerabilities within 24 hours, also for products already sold. From 11 December 2027 it also needs an SBOM, vulnerability handling and free security updates for the whole support period.
Anyone who puts a product with digital elements on the EU market
Manufacturers, importers and distributors of hardware and software that connects to a device or a network. The manufacturer carries most of the duties.
Report an actively exploited vulnerability in three steps
The same deadlines apply to a severe incident, with a final report one month after the notification. Reports go to the national CSIRT and to ENISA through the single reporting platform.
- Early warning within 24 hoursFrom the moment you become aware of it.
- Notification within 72 hoursThe product, the exploit and the measures users can take.
- Final report within 14 daysAfter a fix or a mitigation is available.
After becoming aware of an actively exploited vulnerability or a severe incident […] the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users
the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027
Build every new product to the essential requirements
- No known exploitable vulnerabilities when the product is made available Annex I, Part I(2)(a)
- An SBOM in a commonly used, machine-readable format, at least of the top-level dependencies Annex I, Part II(1)
- Vulnerability handling for the whole support period, at least five years Article 13(8)
- Security updates without delay and free of charge, unless agreed otherwise for a tailor-made product Annex I, Part II(8)
- A policy on coordinated vulnerability disclosure Annex I, Part II(5)
- Technical documentation and EU declaration of conformity for 10 years or the support period, whichever is longer Article 13(13)
What to do first
- List your products and the software inside each one
- Decide who receives and sends a report within 24 hours
- Start the SBOM for one product
- Set up a way to reach the users of each delivered product
You sign the declaration of conformity. We prepare the evidence: which delivered product is exposed, what to tell the customer and what you did.
Which products help, and why
Shield Lifecycle
SBOM, vulnerability handling and VEX for every delivered product, Article 14 reports, customer notices and documentation.
Article 13, Article 14, Annex I
Explore Shield Lifecycle Helps with a partEdge Shield
Reduces the attack surface of the product.
Annex I, Part I, 2(j)
Explore Edge ShieldQuestions about the CRA
Does the CRA apply to products I sold before December 2027?
The reporting duty of Article 14 does, since 11 September 2026. The other requirements apply to those products only if they are substantially modified from 11 December 2027 (Article 69).
Is a machine a product with digital elements?
A machine with a PLC, an HMI or a remote access gateway contains software and connects to a device or a network. So it is a product with digital elements, and its manufacturer has the duties of the CRA.
Who receives the 24-hour report?
The CSIRT designated as coordinator in the Member State of your main establishment, and ENISA at the same time, through the single reporting platform (Article 14).
How long is the support period?
At least five years, unless the product is expected to be in use for less. It must reflect how long the product is expected to be in use (Article 13(8)).
Can a small company be fined for a late report?
Micro and small enterprises cannot be fined for missing the 24-hour early warning (Article 64(10)). The duty to report still applies to them.
Where are you against 20 January 2027?
Seven questions about how you work today. Three minutes. You get a score out of 10 and what is missing for you.
Meet us at 35.BI-MU, fieramilano Rho, 13–16 October 2026