Overview of the Cyber Resilience Act (CRA)
The Cyber Resilience Act (CRA) is a horizontal EU regulation designed to enhance cybersecurity standards for digital products with digital connections, including hardware and software. Enforced in stages since 11 September 2026, the CRA introduces mandatory requirements for vulnerability handling, secure-by-default design principles, and reporting of actively exploited vulnerabilities. Its scope covers products whose intended or foreseeable use involves direct or indirect data connections to devices or networks, such as Internet of Things (IoT) devices and smart systems. The regulation aims to address growing cybersecurity risks, including severe disruptions to economic and social activities, life-threatening vulnerabilities, and the estimated €5.5 trillion annual cost of cybercrime globally by 2021.
The CRA was proposed by the European Commission on 15 September 2022, following widespread concerns about the security flaws in digital products and the increasing threat posed by cyberattacks on critical infrastructures like public administration and healthcare. The regulation was formally approved by the European Parliament in March 2024 and adopted by the Council on 10 October 2024. It entered into force on 11 September 2026, with phased implementation requiring manufacturers to adapt within two years and implement vulnerability and incident reporting within one year of the law’s passage.
The CRA rebalances responsibility for cybersecurity from consumers and volunteers toward manufacturers, imposing a duty of care throughout the product lifecycle. This includes conducting cyber risk assessments before market entry, maintaining documentation for at least 10 years post-market, and ensuring products meet a minimum level of cybersecurity checks if they carry the CE marking. Non-compliance can result in fines of up to €15 million or 2.5% of a company’s total worldwide annual turnover, though fines do not apply to non-commercial open-source developers.
Key Requirements and Implementation Mechanisms
The CRA categorizes digital products into three risk tiers: default, important, and critical. Approximately 90% of products fall under the default category, where manufacturers self-assess security, issue an EU declaration of conformity, and provide technical documentation. Products deemed important or critical undergo stricter evaluations, with critical products requiring external audits. Security-important products are further divided into risk classes to tailor compliance requirements.
For software, the CRA mandates automatic security updates by default for products reasonably expected to support them, with users allowed to opt out. When feasible, security updates must be separated from feature updates. Manufacturers must notify the European Union Agency for Cybersecurity (ENISA) of cybersecurity incidents within 24 hours of discovery and take measures to resolve them. The regulation also clarifies that spare parts with digital elements supplied by the original manufacturer are exempt from certain requirements, reducing administrative burdens for businesses.
The implementation timeline includes a two-year transition period for manufacturers to adapt to new requirements and a one-year period to implement vulnerability and incident reporting. The Czech National Office for Cyber and Information Security (NÚKIB) announced its plan to enforce the CRA starting late 2027, following a three-year transition phase. NÚKIB will hold consultations with manufacturers of significant and critical products to develop technical specifications and gather feedback, ensuring practical applicability of the regulation.
The CRA also introduces the concept of an open-source steward, a new economic actor recognized within the regulation to acknowledge the role of foundations and platforms in the open-source ecosystem. This amendment, part of the political agreement reached on 1 December 2023, addresses earlier criticisms from open-source organizations, which had warned of a chilling effect on development due to unclear commercial activity definitions and excessive regulatory burdens. The revised bill exempts non-commercial open-source developers from fines and simplifies compliance for small businesses redistributing open-source software.
Reception and Amendments to the CRA
Initially, the CRA faced significant criticism from open-source advocates, including organizations like the Eclipse Foundation, Open Source Initiative (OSI), and The Document Foundation. These groups argued that the regulation, as proposed, would disproportionately affect open-source software—accounting for over 70% of software in Europe—without adequate consultation. Concerns included unclear definitions of commercial activity, misalignment with other EU rules, and the disclosure of unmitigated vulnerabilities, which could expose users to unnecessary risks. The Apache Software Foundation and Mozilla also raised concerns about the feasibility of securing open-source projects to government standards, given resource constraints.
Amendments introduced on 1 December 2023 addressed many of these concerns by excluding open-source projects, communities, and foundations from stricter compliance requirements. The revised legislation also introduced the open-source steward role, recognizing the unique contributions of open-source ecosystems. While organizations like Debian and OSI welcomed the changes, they noted ongoing challenges for small businesses and solo developers navigating redistribution requirements. The Eclipse Foundation launched the Open Regulatory Compliance working group in September 2024 to assist open-source communities in complying with evolving regulations, reflecting the ongoing need for collaboration between policymakers and developers.
Despite initial resistance, the CRA’s final form represents a balanced approach to cybersecurity, aiming to protect consumers and businesses while accommodating the diverse needs of the digital product landscape. The regulation’s phased rollout and targeted exemptions for open-source developers underscore its commitment to fostering innovation without compromising security.
Key dates
- 10 Dec 2024Entry into force
- 11 Jun 2026Provisions on conformity assessment bodies apply
- 11 Sept 2026Reporting of actively exploited vulnerabilities and severe incidents begins
- 11 Dec 2027All remaining obligations apply