Cyber Resilience Act (CRA)
From 11 December 2027, no product with digital elements can be placed on the EU market unless it meets the CRA requirements and carries the CE marking. We help manufacturers, importers and distributors get their processes and documentation in order, so their products earn the CE marking and stay on the European market.
What is CRA and who does it affect?
Cyber Resilience Act (CRA) is an EU regulation that sets cybersecurity rules for products with digital elements placed on the EU market.
It goes well beyond technical security and covers the entire product lifecycle: cybersecurity risk assessment, vulnerability handling, security updates and the support period, right through to technical documentation, conformity assessment and CE marking.
The rules apply to manufacturers, importers and distributors of products with digital elements.
"We're building a SaaS platform or a mobile app."
If your product connects to other systems and you offer it on the EU market, it most likely counts as a product with digital elements. That makes you a manufacturer under the CRA, with obligations ranging from documentation and vulnerability monitoring to conformity assessment.
"We import IoT products from Asia and sell them on to B2B partners."
You're an importer under the CRA. Your main job is to make sure the manufacturer has met the CRA requirements, check the documentation and CE marking, and add your own details to the documentation. One thing to watch: if you place products on the market under your own name or trademark, for example, you may take on the same obligations as the manufacturer.
"We distribute digital products on the Czech market."
Distributors aren't off the hook either. You need to check that the product carries the CE marking and comes with the required documentation and contact details for the manufacturer and importer. If something doesn't comply, you must stop supplying the product. And just like importers, if you place products on the market under your own name or trademark, you may take on the same obligations as the manufacturer.
"We're a Czech manufacturer of IoT devices and we sell to Germany."
You're a manufacturer under the CRA. You'll need to show that your product is secure by default, carry out a cybersecurity risk assessment, prepare technical documentation and provide security updates for a support period of at least five years.
- Penalties for non-compliance
A non-compliant product can cost you up to EUR 15 million or 2.5% of worldwide annual turnover in fines, and it can be withdrawn from the market or banned from sale.
- No CE marking, no EU market
To be placed on the EU market, products with digital elements must meet the CRA requirements, pass a conformity assessment and carry the CE marking.
- Products with digital elements
The CRA covers software, hardware, IoT devices, embedded solutions, mobile apps and other products with digital elements.
How can we help
We'll show you where you stand on the CRA and take you through the preparation step by step. Where deeper technical expertise is called for, we bring in trusted partners we've worked with for years. We can run the whole project for you, or recommend the right partners and handle the coordination. Already have ISO 27001 in place, or working on the Czech Cybersecurity Act? We'll build on what you've already set up and tie it in with the CRA in a way that makes sense.
Impact assessment and gap analysis
- We assess whether and which of your products fall under the CRA and in what role you act (manufacturer, importer, distributor).
- We determine the product classification, which defines the path to conformity assessment.
- We compare your current processes and documentation with CRA requirements and show what is missing, what to adjust and what to prioritise.
Output: a gap analysis with a prioritized preparation plan.
Getting you compliant
- We draw up a cybersecurity risk analysis, on which the CRA builds further obligations.
- We prepare the basis for technical documentation so that it is possible to demonstrate how the CRA requirements were addressed – including the SBOM and CVD policy.
- We support you in the conformity assessment according to the product classification. For Default and Class I products, this involves self-assessment by the manufacturer – we prepare the documentation as well as the EU declaration of conformity.
- Once the methodologies and further procedures are known, we will help prepare the supporting materials and coordinate the entire process.
Output: a complete documentation package ready for conformity assessment.
Operations, ongoing compliance and training
- We set up a procedure for reporting actively exploited vulnerabilities and serious incidents.
- We explain the CRA clearly to management and to the operational teams that will handle the new obligations – we will prepare a training tailored specially for you.
- For importers and distributors, we prepare a checklist of what they must verify before placing a product on the market and how to work with the manufacturer's documentation.
Output: processes and checklists for long-term CRA compliance in day-to-day operations.
TRUSTED BY ORGANISATIONS IN MANUFACTURING, IT, ENERGY AND BEYOND
What duties does the CRA introduce?
The CRA divides obligations according to a company's role in the supply chain. Manufacturers have the most obligations, but the new requirements also affect importers and distributors. For all of them, compliance with the CRA requirements will need to be demonstrated before a product is placed on the EU market.
Main obligations of manufacturers
- Design, develop and manufacture the product with digital elements in line with security by default principles.
- Carry out a risk analysis.
- Prepare and maintain technical documentation.
- Ensure security updates throughout the product's support period.
- Carry out a conformity assessment of the product.
- Draw up an EU declaration of conformity.
- Monitor vulnerabilities and report incidents and vulnerabilities affecting the product.
Main obligations of importers
- Verify that the manufacturer has met its obligations under the CRA.
- Check the conformity assessment, documentation and CE marking.
- Add their identification details and contact information to the documentation.
- Not place a product that does not comply with the CRA on the EU market.
- Cooperate with supervisory authorities.
Main obligations of distributors
- Verify that the manufacturer and importer have met their obligations.
- Check the conformity assessment, documentation and CE marking.
- Verify the presence of the manufacturer's and importer's contact details in the documentation.
- Notify the manufacturer of actively exploited vulnerabilities affecting the product.
Get to grips with the CRA on CRA Point
We're building an information platform for manufacturers, importers and distributors, with practical tools to help you:
- run a basic self-assessment of your product,
- dig deeper with a detailed gap analysis,
- work through your obligations with practical checklists,
- make sense of the CRA requirements and plan your next steps.
Our project CRA Point is supported through financial support to third parties (FSTP) under the project Building Testing and Certification Capabilities in the Czech Republic (TEST-CERT-CZ), funded by the Digital Europe Programme.
Frequently asked questions
Does the CRA apply to our company too?
The CRA applies to manufacturers, importers and distributors of products with digital elements. It probably affects you if you develop software under your own brand, place a digital product on the EU market, import one from outside the EU or distribute a product with digital elements. The first step is to work out which role you play for each product: manufacturer, importer or distributor. If you're not sure, that's the first thing to settle.
What counts as a product with digital elements?
The CRA defines it as any hardware or software product that can connect to a network or another device, including its remote data processing solutions where the manufacturer designed them and the product couldn't do its job without them. In short: if your product has a digital function and communicates with the outside world, it's very likely a product with digital elements. Typical examples are mobile and web apps, operating systems, cloud-connected platforms, smart home devices, industrial IoT solutions, routers, cameras, wearables and production technology with embedded software.
The CRA doesn't apply to some product categories, that already have their own sector-specific cybersecurity rules, such as medical devices, motor vehicles and certified aviation systems. Products for national security and defence are also excluded, as is non-commercial free and open-source software.
We're "only" an importer or distributor. What do we need to do?
The CRA isn't just for manufacturers; importers and distributors have obligations too. You won't have to do everything a manufacturer does, but you can't simply take a product and sell it on unchecked. You need to verify the basics: does the product carry the CE marking, and does it come with the required documentation and manufacturer information? If something doesn't comply, you can't keep supplying it and you have to help put things right. And if you place an imported or distributed product on the market under your own name or trademark, for example, you may face the same obligations as the manufacturer.
When does each obligation start to apply?
Since 11 September 2026 actively exploited vulnerabilities and severe incidents have had to be reported, and that includes products you've been selling for years. From 11 December 2027 new products with digital elements can't be placed on the EU market unless they meet the CRA requirements and carry the CE marking. We help manufacturers, importers and distributors get their processes and documentation ready in good time, with no last-minute scramble.
What is the difference between the CRA, CSA and NIS2?
CRA (Cyber Resilience Act) addresses the security of products with digital elements – that is, what software and hardware must meet in order to reach the EU market. The CSA (Cybersecurity Act) is a framework for European cybersecurity certification; it does not impose general obligations on all products. NIS2 (Network and Information Security) targets organisations and their services, not products themselves. In the Czech Republic, the requirements of the NIS Directive are transposed into the Cybersecurity Act. Simply put: the CRA addresses the product, NIS2 the organisation, and the CSA certification schemes.
What if our product is developed outside the EU?
Where your product is developed doesn't settle the matter. If it's placed on the EU market, the CRA can apply to a product developed outside the European Union too.. What matters is who counts as the manufacturer, the importer and the distributor under the CRA, because that role determines your obligations, your documentation and who is responsible for the product's compliance.
The CRA deadlines are fixed. Don't leave it too late
If the CRA applies to you, time is limited. You'll need to adapt your processes, build in security by default and prepare your technical documentation, ideally well before the obligations apply in full and the pressure is on.
10. 12. 2024
Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force.
11. 9. 2026
Reporting of actively exploited vulnerabilities and severe incidents becomes mandatory, with the first notification due within 24 hours.
11. 12. 2027
The CRA applies in full. Products with digital elements that don't meet its requirements can no longer be placed on the EU market.
Start with a free CRA consultation
We'll check whether the Cyber Resilience Act applies to your products, walk you through your obligations, and show you what to prepare and how to tackle it, so you're CRA-ready in time.