Have the law on your side. Anytime. Anywhere. | Forlex

The European Cyber Resilience Act (“CRA”), i.e., Regulation (EU) 2024/2847, introduces harmonized cybersecurity rules for products with digital elements placed on the European Union market.

Although most obligations will not become effective until December 11, 2027, the first significant obligations for manufacturers will take effect as early as September 11, 2026.

Who and what does the CRA apply to?

The CRA applies primarily to manufacturers of hardware and software products whose usage involves a direct or indirect data connection to another device or network.

This may include, for example, software, firmware, computers, smart devices, industrial IoT devices, or certain separately marketed components. A connection does not necessarily mean internet access only – it may also include, for example, USB, Ethernet, Bluetooth, or a software interface.

The CRA does not impose obligations solely on manufacturers. Certain obligations also apply to importers and distributors of products placed on the European market.

What takes effect on September 11, 2026?

Starting on September 11, 2026, the reporting obligations under Article 14 of the CRA will take effect.

Manufacturers will be required to report through a unified European reporting platform, specifically:

• actively exploited vulnerabilities; and

• severe incidents affecting the security of their products.

In relevant cases, the initial notification must be submitted no later than 24 hours after the manufacturer becomes aware of the issue. At the same time, an obligation to inform affected users of the product may also occur.

What changes from 11 December 2027?

From 11 December 2027, the CRA will apply in full.

Manufacturers will be required, among other things, to:

• take cybersecurity into account as early as the product design and development stage;

• conduct cybersecurity risk assessments;

• establish processes for handling vulnerabilities;

• provide necessary security updates;

• maintain technical documentation;

• conduct the relevant conformity assessment;

• draw up an EU declaration of conformity and ensure CE marking.

The new requirements will be assessed in relation to each individual product, and not simply to a model or product line. Accordingly, even if a manufacturer has been selling the same model prior to 2027, new units placed on the market after December 11, 2027, will have to comply with the CRA.

Products placed on the market before that date will generally not have that to be brought into full compliance with the CRA retroactively, unless they subsequently undergo a substantial modification. However, the reporting obligations applicable starting in September 2026 will also apply to such products.

Preparation should not be postponed

Although the CRA will apply in full from December 2027, its requirements concern the design, development, documentation, and subsequent support of products. It is therefore advisable to evaluate now which products fall within the scope of the CRA and which internal processes will need to be adjusted.

If you are unsure whether the CRA applies to your products, or if you need assistance with preparing for the new obligations, we will be happy to review your specific situation and help you determine the appropriate next steps.