e-book

Cyber Resilience Act

Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents. This e-book explains who the CRA applies to, how to work out which category your product falls into, and what obligations follow.

From product to obligations

For companies, the first priority is to establish whether their products fall under the CRA, which category they belong to and what obligations follow. Manufacturers, importers and distributors each have different obligations. The e-book explains the parts of the regulation you need to get a realistic picture of how the CRA affects your products and to plan your next steps.

What the e-book covers

Which products the CRA covers

What the CRA considers a product with digital elements, which products the regulation applies to, and where exemptions apply.

Obligations from 11 September 2026

Reporting of actively exploited vulnerabilities and severe incidents has been mandatory since 11 September 2026.

How conformity is demonstrated

The product category determines whether you can carry out the conformity assessment yourself or need to involve a third party.

What manufacturers need to address

Product security requirements, documentation, vulnerability handling, security updates and other obligations throughout the product lifecycle.

7 chaptersto help you find your way around the CRA

The e-book gives you a sense of what you will need to deal with, how demanding the road ahead may be and where to start. Once you've read it, you'll be better placed to make your first decisions:

whether your product may fall under the CRA,
which category it needs to be classified in,
how demanding the conformity assessment may be,
what obligations await manufacturers, importers and distributors,
what you will need to address in terms of vulnerabilities, updates and documentation.

If you'd rather not go it alone, get in touch. We'll assess the impact of the CRA on your products, determine their category and get you ready to meet your obligations. How we help with the CRA →

Who will benefit most from the e-book

Hardware and software manufacturers. You need to find out whether your products fall under the CRA and what you will have to change in development and related processes to keep placing them on the EU market.
Importers and distributors of products with digital elements, including those who supply them under their own brand.
Product and development teams. In particular, roles within organisations responsible for development, product management, compliance or certification.

Download the e-book

The first CRA obligations have applied since 11 September 2026; the rest follow from 11 December 2027. The e-book will help you find out whether your products fall under the CRA and where to start.