Are You Ready for a €15 Million Non-Compliance Fine?
If you ship software or hardware in the EU, unaddressed CRA obligations or late exploit reporting can trigger instant product bans across all 27 member states.
Understanding the Regulation
What is the Cyber Resilience Act?
The EU CRA (Regulation 2024/2847) is a landmark law setting mandatory cybersecurity requirements for all products with digital elements sold in the EU — from mobile apps to industrial IoT devices.
Scope: Products with Digital Elements
Any hardware or software product connected directly or indirectly to a network, sold in the EU. This includes mobile apps, IoT devices, operating systems, firmware, and open-source software with commercial use.
Three Product Categories
Default (90% of products) — self-assessment by manufacturer. Class I Important — third-party audit or strict self-assessment. Class II Critical — mandatory third-party certification by accredited body.
Essential Requirements (21 Total)
Products must be designed with security by default, include no known exploitable vulnerabilities, receive security updates throughout their lifecycle, and carry a Declaration of Conformity plus CE marking.
Reporting Obligations (from Sept 2026)
Actively exploited vulnerabilities must be reported to ENISA within 24 hours. A full notification within 72 hours. A final report within 14 days. All through the ENISA Single Reporting Platform (SRP).
Your Obligations
Who Does the CRA Affect?
If you sell, distribute, or import any digital product into the EU market — the CRA applies to you. Here are the key segments and their obligations.
Mobile App Developers
Android and iOS app developers fall under the default category. Self-assessment is required, along with a Declaration of Conformity, SBOM, and vulnerability management process before Dec 2027.
★ Most common caseSMEs & Startups
Companies with under 50 employees get some relief on the 24h early warning timing, but must still report. ENISA is specifically mandated to provide dedicated helpdesk support for microenterprises.
Limited exemptionsOpen Source Maintainers
Pure hobbyist OSS is exempt. OSS with commercial support or funding falls under the "open source steward" role. OSS bundled into a commercial product — full manufacturer rules apply.
Complex rules applyNon-EU Businesses
Any company outside the EU selling digital products to EU customers must comply. You must appoint an EU-based authorised representative and submit via the CSIRT of their country.
Full compliance requiredIoT & Hardware Makers
Smart home devices, industrial systems, and connected hardware are in scope. Many fall into Class I or Class II, requiring third-party conformity assessment — not just self-declaration.
Higher risk categoryImporters & Distributors
If a manufacturer outside the EU doesn't comply, the importer or distributor becomes legally responsible. Supply chain due diligence is now a legal obligation, not a best practice.
New liability exposureKey Milestones
CRA Compliance Timeline
The CRA is being phased in over a 36-month window. Here are the dates that matter for any business shipping a digital product into the EU.
- 10 Dec 2024 Done
CRA Enters Into Force
EU Regulation 2024/2847 officially published in the Official Journal. The 36-month main transition window starts.
- 11 Sep 2026 In ~5 months
Vulnerability Reporting Begins
From this date, manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA. The 24h / 72h / 14d timeline applies.
- 11 Dec 2027 ~20 months
Full CRA Compliance Deadline
All products with digital elements placed on the EU market must conform with the CRA, carry CE marking, and have a Declaration of Conformity.
- 2027 onwards Enforcement era
Market Surveillance
National authorities begin enforcement. Non-conforming products can be banned from the EU market. Fines up to €15M or 2.5% of global turnover.
Free Compliance Assessment
Is Your Product CRA Ready?
Get a free personalised CRA compliance briefing for your specific product type, delivered to your inbox. No spam, no sales calls.
- ★ Understand your exact product category (default, Class I, or Class II)
- ★ Get a checklist of your specific obligations and deadlines
- ★ Receive guidance on SBOM, vulnerability management, and reporting
- ★ Early access to our CRA Compliance Manager tool (launching 2026)
- ★ Weekly CRA news digest: ENISA updates, regulatory guidance
Get Your Free CRA Brief
Takes 60 seconds · Completely free
Request received
You're on the list
We've got your details. Your personalised CRA brief is prepared by hand, so give us a working day or two and watch your inbox.
Meanwhile, check your product class →🔒 No spam. Unsubscribe anytime. See our privacy policy.
Free Resources
Guides, Checklists, and Tools
Everything we publish is free and SEO-optimised so you can find what you need fast. Bookmark this page — it's updated as ENISA publishes new guidance.
Generate a CRA-compliant SBOM in 15 minutes
Pick a format, run the generator for your stack (Node, Python, Go, Java, .NET, containers), validate, scan, and wire it into CI. Copy-paste commands throughout.
Read → Explainer · 8 min readAre pre-2027 products grandfathered under the CRA?
Article 69 creates a real but narrow grandfathering carve-out — until "substantial modification" trips the trigger. What that means in practice.
Read → Guide · 12 min readCRA for Mobile App Developers
Everything Android and iOS developers need to know — from the SBOM requirement to the Declaration of Conformity.
Read → Explainer · 8 min readOpen Source & the CRA
When does the CRA apply to OSS? What does the "open source steward" role mean? Hobbyists vs commercial maintainers.
Read → How-to · 6 min readENISA Single Reporting Platform (SRP)
How to register, what data to submit, and how the 24h / 72h / 14-day reporting timeline actually works.
Read → ReferenceSBOM Requirements Explained
CycloneDX vs SPDX, what the CRA actually requires, and tools for generating SBOMs automatically.
Read → FAQ · 50 questionsFrequently Asked Questions
Answers from ENISA guidance and the regulation itself — covering scope, fines, exemptions, and timelines.
Read → TrackerDeadline Tracker
A live countdown to every CRA deadline plus a checklist of what to do before each one.
Read →Our Paid Tools
Everything you need to ship CRA-compliant software.
We build the tools we wished existed when we first read Regulation 2024/2847. They're optional — every guide on this site is free and complete.
CRA Compliance Manager
A self-service workspace to classify your product, generate your SBOM, draft your Declaration of Conformity, and track your essential-requirement gap analysis.
- ★Auto-classification (Default / Class I / Class II)
- ★CycloneDX & SPDX SBOM generation
- ★Declaration of Conformity templates
- ★Audit-ready evidence vault
CRA Incident Reporter
Pre-formatted forms for the ENISA Single Reporting Platform with built-in timers for the 24h / 72h / 14d deadlines, plus templated language for early warnings and final reports.
- ★ENISA SRP-aligned schemas
- ★24h / 72h / 14d deadline timers
- ★Multi-CSIRT routing
- ★Audit log + immutable archive