Overview of Regulation (EU) 2024/2847 — Cyber Resilience Act
The Cyber Resilience Act (CRA) is an EU regulation designed to enhance cybersecurity standards for digital products sold within the European Union and European Economic Area. It establishes mandatory cybersecurity requirements for hardware and software, including AI-enabled products, to ensure they are secure by design and throughout their lifecycle. The regulation addresses vulnerabilities, incident reporting, and secure updates, aiming to mitigate risks posed by cyber threats to consumers, businesses, and critical infrastructures.
The CRA was proposed by the European Commission on 15 September 2022, following extensive discussions and amendments. It was formally approved by the European Parliament in March 2024 and adopted by the Council on 10 October 2024. The regulation entered into force in stages, with key provisions such as 24-hour incident reporting becoming effective from September 2026, and full application scheduled for December 2027.
Key Objectives and Motivations
According to estimates, global annual costs of cybercrime reached €5.5 trillion by 2021, highlighting the need for stronger regulatory measures. The regulation seeks to rebalance responsibility for cybersecurity from consumers and volunteers to manufacturers, ensuring that digital products are secure by default and throughout their lifecycle.
The CRA aims to address risks posed by rogue states or non-state actors targeting critical infrastructures such as public administration and healthcare systems. By setting common cybersecurity standards, the regulation intends to create a more resilient digital environment within the EU, potentially influencing global cybersecurity practices. The act also aligns with broader EU goals of digital sovereignty and innovation, though its implementation has sparked debates over its impact on open-source software development.
Scope and Applicability of the Regulation
The CRA applies to digital products with digital elements whose intended or foreseeable use includes direct or indirect data connection to a device or network. This includes hardware, software, and AI-enabled products sold in the EU market. The regulation categorizes products into three tiers: default, important, and critical, based on their risk level.
- Default category: Covers approximately 90% of products, requiring manufacturers to self-assess security, provide an EU declaration of conformity, and maintain technical documentation for 10 years post-market or the product’s support period, whichever is longer.
- Important category: Products are divided into two risk classes, requiring enhanced security measures but no mandatory external audits.
- Critical category: Products must undergo external audits to ensure compliance with stringent cybersecurity standards.
Products bearing the CE marking must meet minimum cybersecurity checks, ensuring compliance with EU standards. The regulation also mandates that software expected to have automatic updates must deploy security updates by default, with users able to opt out. Security updates should be separated from feature updates where feasible.
Implementation Mechanisms and Compliance Requirements
Manufacturers are required to conduct cyber risk assessments before introducing a product to the market. They must also notify the European Union Agency for Cybersecurity (ENISA) of any cybersecurity incidents within 24 hours of discovery and take measures to resolve them. Documentation and data inventories must be retained for at least 10 years after the product’s market release or its support period, whichever is longer.
The CRA introduces fines for non-compliance, up to €15 million or 2.5% of the offender’s total worldwide annual turnover for the preceding financial year. Exceptions apply to non-commercial open-source developers, who are exempt from fines. The regulation also includes provisions for spare parts with digital elements supplied by the original manufacturer, which are exempt from new requirements.
To ease the transition, manufacturers have a two-year adaptation period and a one-year window to implement vulnerability and incident reporting. The Czech National Office for Cyber and Information Security (NÚKIB) announced plans to enforce the CRA starting late 2027, following a three-year transition period. Technical specifications and consultations with manufacturers of significant and critical products are ongoing to refine implementation details.
Impact on Open-Source Software and Industry Reception
The initial proposal of the CRA faced criticism from open-source advocates, who argued that it could create a chilling effect on development due to unclear requirements and administrative burdens. Organizations such as the Eclipse Foundation, Open Source Initiative (OSI), and The Document Foundation raised concerns about the regulation’s potential to stifle innovation and increase compliance costs for small businesses and solo developers.
Amendments introduced on 1 December 2023 addressed some of these concerns by excluding open-source projects, communities, and foundations from certain obligations. The revised legislation introduced the concept of an open-source steward, acknowledging the role of foundations and platforms in the open-source ecosystem. However, debates continue over the applicability of the CRA to critical open-source components and the practical challenges of certification.
While organizations like Mozilla and the Apache Software Foundation welcomed the revised provisions, they emphasized the need for further collaboration with international standards bodies to streamline certification processes. The Open Source Initiative (OSI) and Debian highlighted ongoing challenges for small businesses and redistributors, stressing the importance of clear guidelines to ensure compliance without hindering innovation.
Transition and Enforcement Timeline
The CRA’s implementation follows a phased approach to allow manufacturers adequate time to adapt to new requirements.
- September 2026: Mandatory 24-hour incident reporting obligations take effect.
- December 2027: Full application of the regulation, including all cybersecurity requirements and compliance measures.
The European Commission conducted an impact assessment prior to finalizing the regulation, evaluating its effects on the internal market, supply and demand dynamics, and member states’ preparedness. National cybersecurity agencies, such as NÚKIB in the Czech Republic, are developing technical specifications and consulting with manufacturers to ensure smooth enforcement.
Exemptions and Special Considerations
The CRA includes specific exemptions and considerations to accommodate different sectors and product types. Non-commercial open-source developers are exempt from fines, though they must still adhere to general cybersecurity principles. Spare parts with digital elements supplied by the original manufacturer are also exempt from new requirements, reducing administrative burdens for businesses.
The regulation’s provisions for open-source software were refined to better align with the ecosystem’s unique characteristics. The introduction of the open-source steward role aims to provide clearer pathways for compliance while supporting the sustainability of open-source projects. However, challenges remain in defining the scope of critical open-source components and ensuring their certification aligns with global standards.
Required actions
- Design and build products with digital elements to the essential cybersecurity requirements of Annex I and ship them without known exploitable vulnerabilities - Run vulnerability handling for the support period (at least five years), provide security updates and publish a coordinated disclosure policy - Report actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT within 24 hours (early warning) and 72 hours - Carry out conformity assessment, draw up technical documentation and an SBOM, and affix the CE marking - Products that are high-risk AI systems under the AI Act meet the AI Act cybersecurity requirement by complying with the CRA