Cyber Resilience Act
Vendor-neutral overview of Regulation (EU) 2024/2847 for founders, CTOs, and compliance owners — products with digital elements, risk classes, and the phased application dates. Not legal advice. Does not start a clock.
What is the EU Cyber Resilience Act and when does it apply?
EU Cyber Resilience Act (Regulation (EU) 2024/2847): product classes, Art. 14 from 11 Sep 2026, full application 11 Dec 2027. Not legal advice. Does not start a clock.
Who is covered by the EU Cyber Resilience Act?
Who the EU CRA covers: manufacturer, authorised representative, importer, distributor, open-source software steward. Not a role determination. Not legal advice.
Which software products are in scope of the CRA?
CRA products in scope: default, important I/II (Annex III), critical (Annex IV). Statutory list vs Commission descriptions. Not legal advice. Does not start a clock.
When is SaaS in scope of the EU Cyber Resilience Act?
EU CRA SaaS boundary: product with digital elements vs remote data-processing vs pure service, and the CRA–NIS2 line. Not a determination. Not legal advice.
What does CRA Article 14 require you to report, and when?
CRA cluster overview of Article 14: 24-hour early warning, 72-hour notification, 14-day final report from 11 Sep 2026. Not legal advice. Does not start a clock.
What is the CRA Article 14 24-hour early warning?
CRA Article 14 24-hour early warning to the CSIRT and ENISA via the single reporting platform, from becoming aware. Applies 11 Sep 2026. Not legal advice.
What is the CRA Article 14 72-hour notification?
CRA Article 14 72-hour notification to the CSIRT and ENISA via the single reporting platform, from becoming aware. Applies 11 Sep 2026. Not legal advice.
Where do you submit CRA vulnerability reports?
Manufacturers submit CRA Art. 14 reports to the CSIRT designated as coordinator and ENISA via the single reporting platform. Not legal advice. Does not start a clock.
How does the ENISA single reporting platform workflow work?
ENISA Single Reporting Platform workflow under CRA Article 16: identity, 24h/72h/final entries, CSIRT dissemination. Agency guidance, not the regulation. Not legal advice.
What does the CSIRT designated as coordinator do after a CRA filing?
CRA CSIRT designated as coordinator: Art. 14 receipt, delayed dissemination (Delegated Regulation (EU) 2026/881), manufacturer continuing duties. Not legal advice.
What does the CRA require for coordinated vulnerability disclosure?
CRA Annex I Part II: a coordinated vulnerability disclosure policy, a reporter contact address, and how that sits next to Article 14. Not legal advice. Does not start a clock.
What CRA evidence should manufacturers retain, and for how long?
CRA evidence retention: technical documentation and EU DoC for 10 years after placing on the market or the support period, whichever is longer. Not legal advice.
What is a CRA readiness checklist before 11 December 2027?
CRA readiness checklist by area: scope, essential requirements, vulnerability handling, Art. 14 from 11 Sep 2026, full application 11 Dec 2027. Not legal advice.
What is the CRA Article 14 final report, and when is it due?
CRA Article 14 final report: 14 days after a measure is available vs one month after the 72-hour notification. Applies 11 Sep 2026. Not legal advice.
What does the CRA require for vulnerability handling?
CRA Annex I Part II: SBOM, remediate without delay, testing, CVD policy, contact address. Distinct from Article 14 reporting clocks. Not legal advice.
What does the CRA require for security updates and the support period?
CRA security-update duties: Annex I Part II, Article 13 support period, separation from feature updates, integrity and notification. Not legal advice. Does not start a clock.
Do you need to report this under CRA Article 14?
CRA Article 14 decision tree: actively exploited vs severe incident, manufacturer, clock-start, which rung is due, where it goes. Not legal advice. Does not start a clock.
What are the CRA penalty ceilings, and who enforces them?
CRA Article 64 ceilings: EUR 15 000 000 or 2,5 %, EUR 10 000 000 or 2 %, EUR 5 000 000 or 1 %. Statutory maxima, not typical fines. Not this product's fines. Not legal advice.
What does a CRA Article 14 incident report look like?
Illustrative, fictional CRA Article 14 timeline: 24-hour early warning, 72-hour notification, 14-day final report. Not a real incident. Not legal advice.
What is an actively exploited vulnerability under the CRA?
How the Cyber Resilience Act defines an actively exploited vulnerability (Art. 3(42)), and how it differs from CISA KEV and critical CVSS.