Cyber Resilience Act (CRA): How to Prepare Your Digital Products for Compliance
What does Regulation (EU) 2024/2847 require of manufacturers of products with digital elements?
The Cyber Resilience Act (Regulation (EU) 2024/2847 of 23 October 2024) introduces horizontal cybersecurity requirements for all products with digital elements placed on the EU market. It applies to manufacturers, importers, and distributors regardless of where they are established, provided the product is made available to consumers or businesses in the Union. The core obligation is to ensure, throughout a defined support period, that the product is secure by design, that known vulnerabilities are handled promptly, and that serious incidents are reported to the European Union Agency for Cybersecurity (ENISA) through its single reporting platform.
This article covers the product scope and risk classification, the security obligations at design and post-market stages, the conformity assessment pathways available to manufacturers, and the contribution of GRC software when compliance must be maintained product by product and version by version. It links to the GRC platform that centralises CRA obligations alongside NIS2 and to NIS2 and DORA, complementary texts to the CRA.
Products in scope and risk classes
Regulation (EU) 2024/2847 applies to hardware and software products that include a digital component and are connected directly or indirectly to a network or to another device. Products sold exclusively as services, open-source software developed outside a commercial context, and categories already covered by sector-specific regulations (medical devices, aviation, automotive) are excluded or subject to specific arrangements set out in the Regulation.
The Regulation introduces three risk categories. The default category covers the majority of products; it carries the full set of essential requirements but allows self-assessment of conformity. The important category is divided into two classes: class I products can use certain European standards or be assessed by a notified body, while class II products require mandatory third-party assessment. The critical category is reserved for products specifically listed in an Annex to the Regulation and requires European cybersecurity certification schemes. Correct classification is the starting point because it determines the conformity assessment pathway and the documentation burden.
Security obligations: design, documentation, incident reporting
The essential cybersecurity requirements set by Regulation (EU) 2024/2847 apply at two stages. At the design and development stage, the product must be delivered without known exploitable vulnerabilities, with a secure default configuration, with protection against unauthorised access, and with the ability to receive security updates throughout the support period. The manufacturer must also produce and maintain technical documentation, including a software bill of materials (SBOM) for the components integrated into the product.
At the post-market stage, the manufacturer must handle reported vulnerabilities in a coordinated and timely manner, provide free security updates during the support period, and use ENISA's single reporting platform to notify actively exploited vulnerabilities and serious incidents within the deadlines set by Article 14 of the Regulation. The support period must be communicated to users at the time of purchase and must be proportionate to the expected useful life of the product, subject to a minimum defined in the Regulation for each risk class.
Conformity assessment pathways
Manufacturers in the default category conduct an internal conformity assessment, drawing on harmonised standards published in the Official Journal of the EU. Compliance with those standards creates a presumption of conformity with the corresponding essential requirements. Where no relevant harmonised standard exists or where the manufacturer chooses not to apply one, the assessment must demonstrate conformity directly against the requirements of the Regulation.
For important class I products, the manufacturer may follow the same route if it applies specific harmonised standards; otherwise, it must involve a notified body. For important class II products and critical products, third-party assessment or certification under a European cybersecurity scheme is mandatory. In all cases, the outcome is an EU declaration of conformity and CE marking, both of which must be kept up to date as the product evolves. Market surveillance authorities in each Member State may at any time request the full technical documentation.
How GRC software covers CRA documentation obligations
Complying with the Cyber Resilience Act over the full support period of multiple product lines requires more than a single assessment exercise. It requires a living system: new vulnerabilities are discovered, components are updated, incidents occur, and the regulatory landscape evolves. Maintaining the technical documentation, the SBOM, the vulnerability-disclosure records, and the incident-notification log manually across a product portfolio becomes an audit-risk in itself.
Optivalue.ai provides a platform that guides compliance teams through the documentation structure required by Regulation (EU) 2024/2847, aligning each requirement with the corresponding evidence. The obligation register keeps track of which requirements apply to each product, which conformity assessment pathway is engaged, and which documentation artefacts are current or due for review. Incident and vulnerability records are stored with timestamps and linked to the relevant product version, producing the notification trail that ENISA and national market surveillance authorities may request.
FAQ
Does the CRA apply to non-European manufacturers? Yes. Regulation (EU) 2024/2847 applies to any manufacturer placing a product with digital elements on the EU market, regardless of where the manufacturer is established. Non-EU manufacturers must appoint an authorised representative established in the Union.
What is a software bill of materials (SBOM) under the CRA? An SBOM is a machine-readable inventory of the software components, including open-source libraries, integrated into a product. Regulation (EU) 2024/2847 requires manufacturers to produce and maintain an SBOM as part of the technical documentation and to make it available on request to market surveillance authorities.
What is the support period under the CRA? The support period is the duration during which the manufacturer must provide security updates to address newly discovered vulnerabilities. It must be proportionate to the expected useful life of the product and is subject to minimum durations set in Annex I of Regulation (EU) 2024/2847 for each risk class.
How does the CRA interact with NIS2 and DORA? The CRA, NIS2 (Directive (EU) 2022/2555), and DORA (Regulation (EU) 2022/2554) are complementary. The CRA applies to product manufacturers; NIS2 and DORA apply to operators of essential services and financial entities respectively. A financial entity that develops its own software tools may be subject to all three simultaneously.
What are the consequences of non-compliance with the CRA? Regulation (EU) 2024/2847 provides for market surveillance measures including product withdrawal and prohibition of making products available, and empowers Member States to impose administrative fines up to the amounts specified in Article 64 of the Regulation.
Book a demonstration of Optivalue.ai
<!-- JSON-LD -->
Back to top