Cyber Resilience Act (CRA)
The Regulation applies directly in all Member States, without national transposition. Its obligations take effect in three stages; the reporting obligation has applied since 11 September 2026.
The Cyber Resilience Act is Regulation (EU) 2024/2847, which lays down EU-wide cybersecurity requirements for products with digital elements, from development to the end of the support period. Its official German name is Cyberresilienz-Verordnung; the usual short form is CRA.
Definition in the Regulation
The Regulation was published in the Official Journal of the EU on 20 November 2024 and, under Article 71(1), entered into force on 10 December 2024. Article 1 describes its subject matter: horizontal cybersecurity requirements for hardware and software made available on the EU market. Article 71(2) staggers its application in three stages: Chapter IV on the notification of conformity assessment bodies has applied since 11 June 2026, the reporting obligation under Article 14 since 11 September 2026, and all other provisions apply from 11 December 2027.
Unlike a directive, the Regulation needs no national transposition. Germany's CRA implementation act (CRA-Durchführungsgesetz) only determines which authority is competent; it does not change manufacturers' obligations.
What it means for manufacturers
If you place products containing software or firmware on the EU market, from 11 December 2027 you must meet the essential requirements of Annex I, keep technical documentation, assess conformity and affix the CE marking. The reporting obligation already applies today: actively exploited vulnerabilities and severe incidents must be reported via the ENISA platform within 24 hours. Under Article 69(3), this also applies to products that have been on the market for a long time. The fines under Article 64 (up to EUR 15 million or 2.5 per cent of total worldwide annual turnover) apply only from 11 December 2027.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Product with digital elements
- Annex I (essential cybersecurity requirements)
- Manufacturer
- German CRA implementation act (CRA-Durchführungsgesetz)
- Legacy products (transitional provisions)