Regulation (EU) 2024/2847
Which products the regulation covers, what Annex I asks of them, the reporting duty that already applies, and what has to be in place by December 2027.
The Cyber Resilience Act — Regulation (EU) 2024/2847 — sets cybersecurity requirements for products with digital elements sold in the EU: hardware and software that connect to a device or a network, including the remote data processing they rely on. Manufacturers must design products against the essential requirements in Annex I, handle vulnerabilities throughout a support period of at least five years, carry out a conformity assessment, draw up technical documentation and an EU declaration of conformity, and affix the CE marking. Since 11 September 2026 they must also report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform, starting with an early warning within 24 hours. The rest of the regulation applies from 11 December 2027.
Key takeaways
Scope
The CRA follows the product. If it has digital elements and is made available on the EU market, it is in — unless a sector law already covers it.
Requirements
Two halves of Annex I — the product's own security, and how its manufacturer handles vulnerabilities — plus the obligations that prove both.
Annex I, Part I
An appropriate level of cybersecurity based on risk: no known exploitable vulnerabilities at release, secure-by-default configuration, protection from unauthorised access, confidentiality and integrity of data, data minimisation, availability, a limited attack surface, security logging and the ability to receive security updates.
Annex I, Part II
Components documented in a software bill of materials, vulnerabilities fixed without delay, regular security testing, disclosure of fixed vulnerabilities, a coordinated vulnerability disclosure policy, and security updates distributed free of charge.
Art. 13
A cybersecurity risk assessment, due diligence on third-party components including open source, technical documentation, and a support period of at least five years unless the product's expected use is shorter.
Art. 14
Actively exploited vulnerabilities and severe incidents affecting a product are reported to the coordinating CSIRT and ENISA through the single reporting platform, and users are told what to do.
Art. 32
Internal control for default products; harmonised standards or third-party assessment for important class I products; third-party assessment for class II; and European cybersecurity certification where required for critical products.
Art. 28–30
An EU declaration of conformity and the CE marking before the product is placed on the market, with the technical documentation kept for ten years or the support period, whichever is longer.
Timeline
The regulation applies in stages. Reporting started first; the product requirements follow in December 2027.
Overlaps
EU Cyber Resilience Act rarely arrives alone. Where it meets the other regimes you probably already run.
The CRA governs the products you place on the market; NIS2 governs how you run your own services. A software company can owe both, with separate reports for a product vulnerability and a service incident.
An ISMS covers secure development and vulnerability management practice (A.8.8, A.8.25 to A.8.29). The CRA asks for evidence per product: technical documentation, a software bill of materials and a conformity assessment.
Under the CRA's Article 12, a high-risk AI system that is also a product with digital elements and meets the Annex I essential requirements is deemed to meet the AI Act's cybersecurity requirements in Article 15.
Annex I's data minimisation and confidentiality requirements line up with data protection by design under Article 25, so the same design decisions can evidence both.
On Noru
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
The EU Cyber Resilience Act is one of the frameworks you switch on. Its controls go through verification and map onto the same library as ISO 27001 with their Annex I reference — the quarterly access review that answers A.5.18 also answers Annex I, Part I (2)(d).
Vulnerabilities and pen-test findings are tracked to resolution and linked to risk, so the Part II duty to fix without delay has an owner, a status and a history.
Evidence is collected continuously from GitHub, your cloud accounts and your identity provider, and versioned in the evidence vault — dated records rather than a binder assembled before an assessment.
Not to SaaS as such: services are covered by NIS2. The CRA reaches software only when it is a product, or the remote data processing a product needs to perform one of its functions — the cloud backend of a connected device or a desktop app, for example. A SaaS company that also ships an installable client, an SDK or firmware can owe the CRA for those.
They have applied since 11 September 2026, to every product in scope — including products placed on the market before that date. The product requirements, conformity assessment and CE marking follow on 11 December 2027, and reach products already on the market before then only if they are substantially modified afterwards.
Only when it is made available in the course of a commercial activity. A manufacturer that integrates open-source components is responsible for them in its product and must exercise due diligence. Open-source software stewards — foundations that support projects intended for commercial use — have a lighter set of obligations of their own.
Most products do not: the default category is self-assessed through internal control. Important class I products can self-assess if they fully apply harmonised standards or common specifications, and otherwise need a notified body. Class II products always need third-party assessment, and critical products may require European cybersecurity certification.
For the support period you declare, which must be at least five years unless the product is expected to be in use for less, and should reflect how long users can reasonably expect to use it. Each security update must remain available for at least ten years after it is issued, or for the rest of the support period if that is longer.
Regulatory references on this page were last checked on .
A 45-minute walkthrough of EU Cyber Resilience Act against your own controls, integrations and evidence.
