The Cyber Resilience Act introduces, for the first time, mandatory cybersecurity requirements for all products with digital elements sold in the European Union: connected machinery, automation components, IoT devices, software. Vulnerability reporting obligations apply from 11 September 2026; the full set of requirements from 11 December 2027, with penalties up to €15 million or 2.5% of worldwide turnover. Getting ready is no longer optional: it is a condition for staying on the European market.
Manufacturers, importers and distributors of products with digital elements: builders of connected machinery and plants, producers of automation components and instrumentation, developers of software and of industrial or consumer IoT devices. If your product contains a microprocessor, communicates over a network or runs software, the CRA most likely applies to it.
We determine the CRA class of each product — default, important (class I or II) or critical — based on its core function. Everything follows from the class: default products need self-assessment; important class II products require a mandatory notified body assessment; critical products need European cybersecurity certification.
We benchmark your product and processes against Annex I of the Regulation: security by design, vulnerability handling, security updates, data protection. The outcome is a remediation plan with priorities, timeline and estimated costs.
We set up the process required by Article 14: point of contact, internal assessment flow, reporting timelines (early warning within 24 hours, notification within 72, final report), SBOM (Software Bill of Materials) and coordinated disclosure policy.
We prepare the required technical documentation and guide you through the assessment route that fits your product class, up to the EU declaration of conformity and CE marking.
A preliminary meeting to classify your products and estimate the route, timeline and cost of CRA compliance.
It depends on the product class and the starting point: from a few weeks (default product with good practices already in place) to 6–12 months (class II products or large portfolios). That is why the gap analysis should start now: December 2027 is close for those starting from scratch.
With an inventory and classification of the whole portfolio, grouping products into families with common requirements: most of the work (processes, SBOM, documentation) is designed once and reused.
Open source software integrated into your products falls within your responsibility as a manufacturer: it must be included in the SBOM and covered by your vulnerability handling process. Specific obligations for open source developers apply only in particular cases.
They are complementary: the Machinery Regulation 2023/1230 (applicable from 20 January 2027) requires protection of control systems against corruption; the CRA covers product cybersecurity in a broad sense. Manufacturers of connected machinery must comply with both — ideally as a single project.
Last updated: August 2026.
