Appearance
Cyber Resilience Act (CRA)
The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847. Article 1 of the CRA gives these rules:
- Rules for the making available on the market of products with digital elements.
- Essential cybersecurity requirements “for the design, development and production of products with digital elements”, and obligations for economic operators for these products.
- Essential cybersecurity requirements for the vulnerability handling processes of manufacturers, and obligations for economic operators for these vulnerability handling processes.
- Rules on market surveillance and enforcement.
The CRA applies to products with digital elements made available on the market, “the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network” (Article 2(1)). For the scope and the products that Article 2 does not include, see Scope. The scope test is the same for products that use AI. Article 12 adds rules only for products that are also high-risk AI systems.
Modulos has two Frameworks for the CRA. They are for AI-enabled products. See The CRA in Modulos.
Since 11 September 2026, a manufacturer must report actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements through the single reporting platform. See Article 14.
For the dates, structure, guidance, implementing acts, market surveillance, and penalties of the CRA, see the sections that follow. For more information, see:
- Scope, product categories, and conformity
- Risk assessment and Annex I
- Vulnerability handling and the support period
- Reporting obligations and economic operators
- How to use the CRA Frameworks in Modulos
Key facts
Legislator
European Union
Instrument
Regulation (EU) 2024/2847
In force
10 December 2024
Applies
11 December 2027
Chapter IV from 11 June 2026
Article 14 from 11 September 2026 (manufacturers)
Chapter IV from 11 June 2026
Article 14 from 11 September 2026 (manufacturers)
Covers
Products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network
Modulos Frameworks
OFF-26 (Organization) and MFF-26 (AI System)
Dates and transitional provisions
For economic operators and open-source software stewards, the CRA dates are in Article 71. Regulation (EU) 2024/2847 is in the Official Journal of the European Union of 20 November 2024 (OJ L, 2024/2847). The CRA entered into force “on the twentieth day following that of its publication” (Article 71(1)), that is, on 10 December 2024.
Article 71(2) gives the dates from which the parts of the CRA apply:
| Date | Part of the CRA |
|---|---|
| From 11 June 2026 | Chapter IV (Articles 35 to 51), notification of conformity assessment bodies |
| From 11 September 2026 | Article 14, the reporting obligations of manufacturers, with the information to users in Article 14(8) |
| From 11 December 2027 | All other provisions |
Article 71(2) gives a date before 11 December 2027 only to Article 14 and Chapter IV. Thus, market surveillance and enforcement (Chapter V) and penalties (Article 64) apply from 11 December 2027. See Market surveillance and penalties.
Article 14 gives the reporting obligations to “a manufacturer” (Article 14(1) and (3)). A manufacturer is a person that “develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark” (Article 3(13)). For two other groups, the reporting obligations apply from 11 December 2027:
- Open-source software stewards — Article 24(3) applies Article 14(1), (3), and (8) to stewards, with conditions. The Commission services FAQ gives the date: “In accordance with Article 71(2) of the CRA, Article 24(3) shall apply from 11 December 2027.” The European Union Agency for Cybersecurity (ENISA) gives the same date.
- Persons considered to be a manufacturer — Article 21 (importers and distributors) and Article 22 (other persons) apply from 11 December 2027. Article 71(2) does not give them a different date. Modulos reads Articles 3(13), 14(1), and 71(2) as follows: before 11 December 2027, Article 14 applies to these persons only if they are manufacturers in Article 3(13).
Article 69 gives the transitional provisions for products placed on the market before 11 December 2027:
Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification.
By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027.
Thus, all of Article 14, with Article 14(8), applies to these products. The Commission services FAQ gives this guidance on Article 69(2), which is not binding. The CRA applies to each unit of a product, not to a product type. Thus, “only individual products that have been placed on the market before 11 December 2027 do not need to comply with the CRA”. Also, “Products that are manufactured according to a type that is not compliant with the CRA cannot be placed on the market on or after 11 December 2027”.
Structure of the CRA
The CRA has eight Chapters and eight Annexes. Each row below gives provisions and refers to the section with more information.
| Provisions | Information | More information |
|---|---|---|
| Articles 2 and 3 | The scope (Article 2(1)), the products that the CRA does not include (Article 2(2) to (4), (6), and (7)), and the definitions (Article 3) | Scope, product categories, and conformity |
| Articles 6 to 8, 12, and 32, and Annexes III, IV, and VIII | The conditions to make a product available on the market (Article 6). Important products of Class I and Class II (Article 7, Annex III) and critical products (Article 8, Annex IV). The conformity assessment procedures (Article 32, Annex VIII). High-risk AI systems (Article 12) | Scope, product categories, and conformity |
| Article 13(1) to (7) and Annex I, Part I | The cybersecurity risk assessment. Point (1) of Part I, which gives “an appropriate level of cybersecurity based on the risks”. The thirteen requirements of point (2), (a) to (m), which apply “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable”. Components | Risk assessment and Annex I |
| Article 13(8) to (11) and Annex I, Part II | Vulnerability handling for the support period, the software bill of materials (SBOM), security updates, and coordinated vulnerability disclosure. The support period “shall be at least five years”, or the expected use time if the product is “expected to be in use for less than five years” | Vulnerability handling and the support period |
| Article 13(15) to (20) and Annex II | The identification of the product, the contact information, and the single point of contact. The end date of the support period. The information and instructions to the user | Vulnerability handling and the support period |
| Articles 14 to 17 | The reporting obligations of manufacturers, the information to users (Article 14(8)), voluntary reporting (Article 15), and the single reporting platform (Article 16) | Reporting obligations and economic operators |
| Articles 18 to 24 | Authorized representatives (Article 18), importers (Article 19), distributors (Article 20), persons considered to be a manufacturer (Articles 21 and 22), the identification of economic operators (Article 23), and open-source software stewards (Article 24) | Reporting obligations and economic operators |
| Articles 27 to 31 and Annexes V to VII | Presumption of conformity (Article 27), the EU declaration of conformity (Article 28, Annexes V and VI), the CE marking (Articles 29 and 30), and the technical documentation (Article 31, Annex VII) | Scope, product categories, and conformity |
| Chapter IV (Articles 35 to 51) | Notification of conformity assessment bodies | — |
| Chapter V (Articles 52 to 60) | Market surveillance and enforcement | Market surveillance and penalties |
| Article 64 | Penalties | Market surveillance and penalties |
Guidance and related information
Article 26(1) of the CRA tells the Commission to “publish guidance to assist economic operators in applying this Regulation, with a particular focus on facilitating compliance by microenterprises and small and medium-sized enterprises”.
On 27 July 2026, with Communication C(2026) 5252, the Commission gave its “Approval of the content of the draft Communication from the Commission - Commission guidance on the application of Regulation (EU) 2024/2847 (Cyber Resilience Act)”. The Communication gives this information about the guidance: “The guidance in the Annex to the Communication will be formally adopted by the Commission at a later date, when all language versions are available. It is only from that moment that it will apply.” Point 8 of the guidance also gives this information: “This guidance is not binding for economic operators or other actors subject to the CRA.”
For example, the guidance gives information on scope, substantial modification, the support period, and reporting obligations (Sections 2, 4, 5, and 9.1).
The Commission services also give a FAQ on the CRA (version 1.4 of 4 September 2026). The FAQ “should not be considered as representative of the European Commission's official position”. Also, “The replies to the FAQs do not extend in any way the rights and obligations deriving from applicable legislation nor introduce any additional requirement.”
For more information, see:
- Harmonized standards — Article 27(1) gives manufacturers a presumption of conformity with conditions.
- The SBOM implementing act — In Article 13(24), the Commission “may” “specify the format and elements of the software bill of materials”.
- The simplified technical documentation form — Article 33(5) tells the Commission to “specify” a simplified technical documentation form for microenterprises and small enterprises.
- The guidance C(2026) 5252 — The Communication of 27 July 2026 gives the information in this section about when the guidance applies.
- Digital Omnibus — COM(2025) 837 of 19 November 2025, from the Commission, contains changes to NIS2 and, as of October 2026, is not law.
Market surveillance and penalties
Chapter V of the CRA, “Market surveillance and enforcement” (Articles 52 to 60), gives the procedures of market surveillance authorities. Regulation (EU) 2019/1020 applies to products with digital elements in the scope of the CRA (Article 52(1)). The other Articles of Chapter V are:
- Article 53, “Access to data and documentation”
- Article 54, “Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk”
- Article 55, “Union safeguard procedure”
- Article 56, “Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk”
- Article 57, “Compliant products with digital elements which present a significant cybersecurity risk”
- Article 58, “Formal non-compliance”
- Article 59, “Joint activities of market surveillance authorities”
- Article 60, “Sweeps”
For information on how economic operators must cooperate with market surveillance authorities (Articles 13(22), 53, and 54(1)), see Requests from authorities and records.
Article 64(1) tells each Member State to make the rules on penalties for infringements of the CRA. These penalties must be “effective, proportionate and dissuasive”. Article 64 gives these maximum administrative fines. Each row gives a value in EUR and a part (%) of the total worldwide annual turnover for the preceding financial year. For an undertaking, the maximum fine is the EUR value or the value calculated from its turnover, “whichever is higher”.
| Non-compliance | Maximum administrative fine |
|---|---|
| Articles 13 and 14, and Annex I (Article 64(2)) | EUR 15 000 000 or, for an undertaking, 2.5 % of turnover |
| Articles 18 to 23, 28, 30(1) to (4), 31(1) to (4), 32(1) to (3), 33(5), 39, 41, 47, 49, and 53 (Article 64(3)) | EUR 10 000 000 or, for an undertaking, 2 % of turnover |
| “The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request” (Article 64(4)) | EUR 5 000 000 or, for an undertaking, 1 % of turnover |
For each fine, the authority must use “all relevant circumstances of the specific situation” (Article 64(5)). For example, Article 64(5) names “the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the infringement”. Article 64(10) gives this derogation:
By way of derogation from paragraphs 3 to 9, the administrative fines referred to in those paragraphs shall not apply to the following:
(a) manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a);
(b) any infringement of this Regulation by open-source software stewards.
Article 71(2) does not give a date before 11 December 2027 to Chapter V or to Article 64. The Commission services FAQ gives this information: “the provisions on market surveillance and enforcement, as well as all the other provisions set out in the CRA, apply from 11 December 2027”.
The CRA and other EU laws
In the CRA, a CSIRT is a computer security incident response team. The CRA uses these NIS2 (Directive (EU) 2022/2555) definitions: “incident” (Article 3(43)), “near miss” (Article 3(45)), and “CSIRT designated as coordinator” (Article 3(51)).
In COM(2025) 837 (as of October 2026, not law), a manufacturer’s CRA Article 14(3) notification “shall constitute reporting of information” for NIS2 Article 23(4) if it contains “relevant information as required under paragraph 4 of this Article”.
For high-risk AI systems in CRA scope, CRA Article 12(1) and AI Act Article 42(3) give conditions to be “deemed to comply with the cybersecurity requirements set out in Article 15” of the AI Act.
The CRA in Modulos
Modulos gives the CRA as two Frameworks: OFF-26 at the Organization level and MFF-26 at the AI System level. Each MFF-26 AI System is for one AI-enabled product. The Requirements for authorized representatives, importers, distributors, and open-source software stewards apply only if the Organization is that type of economic operator or a steward. How to use the CRA Frameworks in Modulos gives the decisions, steps, and Requirements. For Controls in the CRA Frameworks and in other Frameworks, see Control overlap.
Where to go next
Scope, product categories, and conformity
The scope of Article 2, remote data processing, product categories, Article 12, harmonized standards, technical documentation, the EU declaration of conformity, and the CE marking
Risk assessment and Annex I
The cybersecurity risk assessment and the requirements of Annex I, Part I
Vulnerability handling and the support period
The requirements of Annex I, Part II, the support period, the SBOM, security updates, and information to users
Reporting obligations and economic operators
Article 14 reports and the obligations of economic operators and open-source software stewards
How to use the CRA Frameworks in Modulos
The two Frameworks, the decisions, the steps, and the Requirements
Frequently asked questions about the Cyber Resilience Act
For short entries about the CRA, see Frequently asked questions about the Cyber Resilience Act.
Sources
- Cyber Resilience Act, Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 “on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)”, OJ L, 2024/2847, 20.11.2024: Articles 1 to 3, 6 to 8, 12 to 33, 35 to 60, 64, 69, and 71, and Annexes I to VIII (EUR-Lex).
- Communication C(2026) 5252 of the European Commission, 27 July 2026, “Approval of the content of the draft Communication from the Commission - Commission guidance on the application of Regulation (EU) 2024/2847 (Cyber Resilience Act)”: the information on when the guidance applies, and point 8 of the guidance in its Annex (European Commission).
- Commission services FAQ, “Cyber Resilience Act - Frequently Asked Questions”, version 1.4 of 4 September 2026: the first part, and the information on open-source software stewards, harmonized standards, and the transitional provisions (European Commission).
- The Commission, “Cyber Resilience Act - Standardisation”, 31 July 2026 (European Commission).
- ENISA news “The CRA Single Reporting Platform is launched”, 11 September 2026 (ENISA).
- COM(2025) 837, Digital Omnibus, European Commission, 19 November 2025: Article 6, with the new Article 23a and Article 23(12) of NIS2 (EUR-Lex). Procedure 2025/0360(COD) of the European Parliament (Legislative Observatory).
- AI Act, Regulation (EU) 2024/1689: Article 42(3), which Regulation (EU) 2026/1744 of 8 July 2026 added (Article 1(18) of Regulation (EU) 2026/1744).
- NIS2, Directive (EU) 2022/2555: Article 6, points (5) and (6), and Article 12(1), to which the CRA definitions refer (EUR-Lex).
Disclaimer
This page gives general information. It is not legal advice. Before you make a decision, read the CRA in the Official Journal and the rules on penalties of each Member State.