Cyber Resilience Act glossary
Regulation (EU) 2024/2847 defines its terms in Article 3, and many obligations turn on exactly those definitions. Each term is briefly explained here, with the article it comes from and the guide that covers it in more depth.
Legal status as of 8 October 2026. Not legal advice.
A
- Actively exploited vulnerabilityA vulnerability with reliable evidence that an attacker has exploited it; triggers the reporting obligation.
- Administrative finePenalty under Article 64: up to EUR 15 million or 2.5 per cent of turnover; applies from 11 December 2027.
- Annex I (essential cybersecurity requirements)The CRA's catalogue of requirements: Part I product properties, Part II vulnerability handling.
- Assigned RepresentativeRole on ENISA's platform that submits notifications for the manufacturer; not the authorised representative.
- Authorised representativePerson established in the EU whom a manufacturer appoints by written mandate to carry out tasks (Article 18).
- Awareness (start of the deadlines)The moment the deadlines start: completion of an initial assessment with a reasonable degree of certainty.
B
- Beg bountyAutomated e-mail with a trivial finding and a request for a reward, usually sent to companies with no bounty.
- BSIGerman Federal Office for Information Security; under the draft act, Germany's central CRA authority.
- BSI TR-03183The BSI's technical guideline on the CRA in four parts; voluntary, no presumption of conformity, influential.
C
- CE markingVisible mark of conformity, affixed after a successful assessment; in future for software too.
- CERT-BundGerman federal computer emergency response team within the BSI; coordinating CSIRT for German manufacturers.
- Change of roleAn importer or distributor becomes the manufacturer if it sells under its own brand or modifies the product.
- Commercial activityDividing line for open source and hobby projects; a price, paid support and data use point towards it.
- Commission guidanceNon-binding interpretive guidance from the Commission under Article 26, C(2026) 5252 of 27 July 2026.
- Conformity assessmentProcedure to show compliance: module A (internal), B plus C (type examination) or H (quality assurance).
- Coordinated vulnerability disclosure (CVD)Orderly process for receiving, fixing and disclosing vulnerabilities; the CRA requires a policy.
- Critical productProduct in one of the three Annex IV categories; certification possible, otherwise assessed like class II.
- CSIRTNational incident response team under NIS2; receives and forwards manufacturers' CRA notifications.
- CSIRT designated as coordinatorThe CSIRT of the Member State of the main establishment; receives the notification and passes it on.
- CVEWorldwide identifier for known vulnerabilities; an entry alone does not trigger the CRA reporting obligation.
- CVSSScale for rating the severity of vulnerabilities; helps with triage, not a reporting criterion under the CRA.
- Cyber Resilience Act (CRA)EU Regulation 2024/2847 laying down cybersecurity requirements for products with digital elements.
- Cybersecurity risk assessmentDocumented assessment of product risks; it shapes planning, development and maintenance (Article 13(2)).
D
- Default categoryProducts that are neither important nor critical; conformity assessed by internal control (module A).
- DistributorPasses on a product without being the manufacturer or importer; checks CE marking and documents (Article 20).
- Due diligence for third-party componentsManufacturers must check bought-in and open-source components so that they do not compromise the product.
E
- Early warning notificationFirst reporting stage within 24 hours of awareness, with deliberately limited information.
- ENISAThe EU's cybersecurity agency; runs the reporting platform and receives every CRA notification.
- EU declaration of conformityDeclaration signed by the manufacturer that the product meets the requirements; content as set out in Annex V.
- EU LoginSign-in service of the EU institutions; required with multi-factor authentication for the reporting platform.
F
G
H
I
- IEC 62443International standards series for industrial automation security; guidance, no presumption of conformity.
- Important product, class IProduct in one of the 19 categories of Annex III, class I; self-assessment only with a harmonised standard.
- Important product, class IIProduct in one of the four categories of Annex III, class II; always assessed by a notified body.
- ImporterPerson established in the EU who places a third-country manufacturer's product on the market (Article 19).
- Information and instructions to the user (Annex II)Mandatory information for users: contact point, intended purpose, end of support, updates, secure set-up.
- Informing users of vulnerabilities and incidentsObligation under Article 14(8) to inform impacted users of a vulnerability or incident and of mitigations.
L
M
- Machinery Regulation (EU) 2023/1230EU machinery law with its own cybersecurity requirements; applies from 20 January 2027 alongside the CRA.
- Making available on the marketAny supply of a product in the course of a commercial activity, whether paid for or free of charge.
- ManufacturerDevelops a product or has it developed, and markets it under its own name; bears the main obligations.
- Market surveillanceSupervision under Articles 52 to 60: checks, document requests, corrective action, withdrawal, recall, sweeps.
- Market surveillance authorityAuthority that checks products on the market, orders measures and imposes fines; in Germany the BSI.
N
O
P
- Placing on the marketFirst making available of a product on the Union market; the reference date for obligations, unit by unit.
- Presumption of conformityApplying harmonised standards means presumed conformity under Article 27; not yet available for any product.
- Product with digital elementsSoftware or hardware product with a data connection, including remote data processing and components.
- PSIRTManufacturer's team for vulnerabilities in its products; not required by name in the CRA, but common practice.
R
S
- Sectoral exclusionsProducts that Article 2(2) to (7) excludes from the CRA because their own EU law governs their security.
- Secure by design and secure by defaultSecurity from the design stage and a secure default configuration on delivery; the core of Annex I, Part I.
- Security advisoryPublication on a fixed vulnerability with its impact, severity and remediation (Annex I, Part II).
- Security updateUpdate fixing vulnerabilities; free of charge, without delay, separate from feature updates where feasible.
- security.txtStandardised text file at /.well-known/security.txt giving the contact address for vulnerability reports.
- Severe incidentIncident that affects the protection of the product's sensitive data or functions, or leads to malicious code.
- Single point of contact for vulnerabilitiesContact point under Article 13(17) through which users get in touch and report vulnerabilities.
- Single reporting platform (SRP)ENISA's central reporting platform under Article 16; a web form in English, live since 11 September 2026.
- Software bill of materials (SBOM)Machine-readable list of a product's software components; required by Annex I, Part II, point (1).
- Substantial modificationChange after placing on the market that affects compliance or intended purpose; triggers a new assessment.
- Support periodTime during which vulnerabilities must be handled; at least five years, end date stated at purchase.
T
V
The reporting obligation already applies. Who answers at night at your company?
CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.