Frequently Asked Questions about the Cyber Resilience Act
How can we help you with the Cyber Resilience Act?
EU Cyber Resilience Act
- What is the EU Cyber Resilience Act?
EU Cyber Resilience Act (CRA) is a EU regulation with the aim of strengthening security requirements in the products with digital components (software) that we use. The fact that it is an EU regulation means that it applies throughout the EU directly without needing to be adapted by each EU country.
- What products are covered by the Cyber Resilience Act?
The products covered are alla products with digital components (software), as defined. This means physical products that contain software but also pure softwareproducts that are installed as an app on a phone or as a program on a computer. If the product talks to a backend, via for example an API, it is also included in the CRA requirements.
- When does the Cyber Resilience Act come into effect?
It comes into force in two stages, with the first part “Reporting obligations” happening now in September 2026 and the remaining full requirements in December 2027.
The first part, “Reporting obligations” in September 2026 means that:- You must report to EU authorities (ENISA) within 24 hours of becoming aware that users of your product(s) are affected by vulnerabilities that are being exploited or that you are affected by a security incident related to the product.
- A complete report must be submitted within 72 hours with
- You should also have the ability to offer an updated version of your product where the exploited vulnerability is fixed.
The second major part in December 2027 means that all your products with digital components must meet all requirements in the CRA:
Essential requirement (13 items)
Vulnerability action (8 pieces)
Based on the cybersecurity risk assessment you have conducted for each product, you implement the requirements you consider relevant.
- How does CRA affect software development?
CRA doesn't really affect software development other than the need to show that you has a functioning process for safe development and that there is documentation that proves that you are working as has been said. For each release you should saves this “evidence” saysmmans with a Software Bill often Materials (SBOM) which lists the components open-source/third-party-components contained in the product.
- How does CRA affect SaaS providers?
Limited direct impact (as the focus is on products). But if a SaaSsolution is used as backend to SaaS-the company's own product with digital components will SaaS-part be included.
- How can businesses prepare for the CRA?
Implement secure development processes, inventory components (SBOM), improve patching and create vulnerability management routines
Determine the product's lifespan (minimum 5 years), which will be the time during which you must provide security updates.
For your own sake and that of your users, you should ensure that the product can be updated easily and automatically.
Automated build and deploy flows to create SBOM and proof that the product has no known exploitable vulnerabilities.