Comply.Land
Cyber Resilience Act (CRA)
The Cyber Resiliency Act otherwise known as the EU CRA entered into force when it was published as Regulation (EU) 2024/2847 in the Official Journal of the European Union, December 10th 2024. Some requirements become mandatory on 11th September 2026 and are fully applied on 11th December 2027.
The Act provides that products with digital elements shall only be made available on the market if they meet essential cybersecurity requirements and the procedures implemented by their manufacturer comply with these requirements.
Why it matters?
For the first time, the EU is treating software and digital components as regulated products.
This means that many tools we use or build — from apps and firmware to libraries and APIs — will fall under product safety law, with mandatory cybersecurity requirements.
The regulation aims to ensure that digital products placed on the EU market are secure by design, properly maintained, and responsibly documented throughout their lifecycle.
What counts as a "product with digital elements"?
According to the CRA, this includes:
Hardware & connected devices
- Laptops, smartphones, IoT devices, routers, industrial control systems
- Smart speakers, sensors, meters, security systems
Software
- Operating systems, mobile apps, web and desktop applications
- Games, developer tools, embedded software, firmware
Components & libraries
- Software libraries, SDKs, CPUs, security chips
- Products sold separately or integrated into other systems
Even individual components can be considered standalone products under CRA rules.
Key requirements for manufacturers
To place a digital product on the EU market, you must:
- Conduct a Cybersecurity Risk Assessment
- Provide a Declaration of Conformity
- Maintain a Software Bill of Materials (SBOM)
- Offer a User Manual that explains security features
- Ensure 5 years of security support
- Keep technical records for 10 years
- Monitor and report actively on vulnerabilities
For critical or high-risk products, a third-party audit (CAB) will be mandatory.
If you're outside the EU...
Companies based outside of the EU must appoint an EU Authorised Representative (EU AR) to legally place digital products on the EU market. This includes software-only businesses, platforms, open-source vendors with commercial use, and SaaS providers.
Penalties for non-compliance
Products that fail to meet CRA requirements may face:
- Fines linked to company revenue
- Mandatory product recall or withdrawal
- Blocking of EU market access by regulators
As Daniel Thompson-Yvetot stated in his CRA keynote:
“If you remember one thing from this regulation, it’s this: your software is now a product. And the EU has a regulatory banhammer.”
Want to explore further?
The book Manufacturing European Software dives deeper into how CRA will affect product teams, developers, and software companies operating in or entering the EU.
Regulated in Malta by the mdia
