Docs

Appearance

Frequently asked questions about the Cyber Resilience Act ​

Each entry gives the rule first, then refers to the section with the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is the EU Cyber Resilience Act? ​

The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847. The CRA gives cybersecurity requirements for products with digital elements in the scope of Article 2, and obligations for economic operators (see Scope). It applies from 11 December 2027. The reporting obligations of manufacturers in Article 14 apply from 11 September 2026. Chapter IV (Articles 35 to 51) applies from 11 June 2026 (dates, Article 71(2)).

Manufacturers must comply with Annex I, Parts I and II, set the support period, prepare technical documentation, and do conformity assessment. Conformity assessment must show conformity before the manufacturer prepares the EU declaration of conformity and affixes the CE marking (Article 13(12)). Importers, distributors, authorized representatives, and open-source software stewards have different obligations (Articles 18 to 24). See Structure of the CRA.

Which products are in scope of the CRA? ​

The CRA applies to products with digital elements made available on the market, “the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network” (Article 2(1)). Products that use AI have the same scope test.

When does the Cyber Resilience Act apply? ​

The CRA applies from 11 December 2027 (Article 71(2)). Chapter IV (notification of conformity assessment bodies) applies from 11 June 2026. The reporting obligations of manufacturers in Article 14 apply from 11 September 2026. Article 24(3) for open-source software stewards, and Articles 21 and 22 for persons “considered to be a manufacturer”, apply from 11 December 2027.

Products placed on the market before 11 December 2027 are subject to the CRA requirements only if they get a substantial modification from that date (Article 69(2)). But Article 14 applies to those products (Article 69(3)). The Commission services FAQ applies Article 69(2) to each unit, not to a product type. The FAQ is not binding. See Dates and transitional provisions.

How does the CRA interact with the EU AI Act for high-risk AI systems? ​

In CRA Article 12(1), products in CRA scope can be “deemed to comply” with AI Act Article 15 cybersecurity requirements. They must be “classified as high-risk AI systems pursuant to Article 6” of the AI Act. The product must comply with Annex I, Part I, and the manufacturer processes with Part II. The CRA EU declaration of conformity must show “the achievement of the level of cybersecurity protection required under Article 15” of the AI Act. The AI Act requirements for “accuracy and robustness” do not change.

AI Act Article 43 conformity assessment applies (CRA Article 12(2)). Article 12(3) gives a derogation for specified important and critical products subject to the AI Act internal-control procedure. See Article 12, its conditions and procedures.

How does Modulos model the Cyber Resilience Act? ​

Modulos gives the CRA as OFF-26 for the Organization and MFF-26 for each AI-enabled product. Add OFF-26 to your organization AI System. If you do not have one, contact Modulos Support.

Each AI System gets all Requirements of its Framework. ORF-479 to ORF-482 apply only to the specified economic operator or steward. If the Organization does not have that “role”, record this decision in ORF-468. Some MFF-26 Requirements also apply to authorized representatives and importers. See decisions about economic operators and stewards and the two CRA Frameworks.

Is there a harmonized standard for the CRA? ​

The Commission’s “Cyber Resilience Act - Standardisation” page of 31 July 2026 names no harmonized standard with an Official Journal reference. It gives standardization request M/606 for 41 standards.

Article 27(1) gives a presumption of conformity when the product and manufacturer processes are in conformity with harmonized standards or parts of them. The standards must have references “published in the Official Journal of the European Union”. The presumption of conformity applies only to the Annex I requirements “covered by those standards or parts thereof”. Common specifications (Article 27(5)) and European cybersecurity certification schemes (Article 27(8)) can also give a presumption of conformity, with their conditions. Annex I applies with or without a standard (Articles 6 and 13(1)). See Harmonized standards.

What are the CRA reporting deadlines? ​

CRA Article 14 tells manufacturers to report actively exploited vulnerabilities in their products and severe incidents having an impact on the security of the product with digital elements. The time limits are:

  • Early warning notification: without undue delay, no more than 24 hours after the manufacturer becomes aware (Article 14(2)(a) and (4)(a)).
  • Vulnerability or incident notification: without undue delay, no more than 72 hours after the manufacturer becomes aware (Article 14(2)(b) and (4)(b)).
  • Vulnerability final report: no more than 14 days after a corrective or mitigating measure is available (Article 14(2)(c)).
  • Incident final report: no more than one month after the incident notification (Article 14(4)(c)).

Vulnerability notifications, incident notifications, and final reports are necessary “unless the relevant information has already been provided”. Routing to the CSIRT designated as coordinator and ENISA follows Article 14(7). Article 14(8) gives conditions for information to users and for “risk mitigation and corrective measures”.

Article 14 applies to manufacturers from 11 September 2026, also for products placed on the market before 11 December 2027 (Article 69(3)). Stewards and persons considered to be a manufacturer have different conditions, from 11 December 2027 (Articles 21, 22, 24(3), and 71(2)).

Does the CRA apply to open-source software? ​

Free and open-source software is in CRA scope only when supplied in a commercial activity, “for payment or free of charge” (Articles 2(1) and 3(22)). Open-source software stewards have Article 24 obligations from 11 December 2027. Article 24(3) has conditions for vulnerability reports where stewards are “involved in the development” of products. For incident reports and user information, it has conditions for effects on systems supplied “for the development of such products”. See steward obligations and the conditions for reports.

Article 64(10) gives a derogation from the administrative fines in paragraphs 3 to 9 for “any infringement of this Regulation by open-source software stewards”. Manufacturers must use due diligence for free and open-source components in their products (Article 13(5)).

What are the penalties under the CRA? ​

Each Member State makes the rules on CRA penalties (Article 64(1)). For non-compliance with Annex I and Articles 13 and 14, the maximum administrative fine is EUR 15 000 000 (Article 64(2)). For an undertaking, the maximum is 2.5 % of its total worldwide annual turnover for the preceding financial year, if that is more than EUR 15 000 000. Article 64(3) and (4) give lower maximum fines for other obligations.

Article 64(10) gives this derogation:

By way of derogation from paragraphs 3 to 9, the administrative fines referred to in those paragraphs shall not apply to the following:

(a) manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a);

(b) any infringement of this Regulation by open-source software stewards.

Market surveillance and enforcement apply from 11 December 2027. See Market surveillance and penalties.

How long is the CRA support period? ​

The manufacturer must set the CRA support period from the expected use time, with a minimum of five years (Article 13(8)). If the expected use time is less than five years, the support period must equal that time.

Article 13 also gives: