In brief
The CRA applies to products with digital elements on the EU market. From 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours – including for products already on the market. By 11 December 2027 products must meet the essential requirements and bear the CE marking.
Is your product in scope of the CRA?
A product with digital elements is in scope if it connects directly or indirectly to a device or network – hardware or software, including remote data processing solutions that are part of the product.
- Exclusions: products covered by specific sectoral rules, such as medical devices, motor vehicles, civil aviation and marine equipment.
- SaaS: pure SaaS is generally out of scope, unless it is a remote data processing solution that is part of a product.
- Roles: manufacturers, importers and distributors have obligations; the manufacturer has the most.
| Category | Where defined | Conformity assessment procedure (Article 32) |
|---|---|---|
| Default category | products not listed in Annex III or IV | the manufacturer itself through internal control (module A); it may also choose EU-type examination (module B) with conformity to type based on internal production control (module C), full quality assurance (module H) or a European cybersecurity certification scheme |
| Important products, class I | Annex III | module A if the manufacturer fully applies harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least “substantial”; otherwise module B + C or module H with a notified body |
| Important products, class II | Annex III | module B + C, module H or a European cybersecurity certification scheme at assurance level at least “substantial” – always with a third party |
| Critical products | Annex IV | a European cybersecurity certification scheme where required by a delegated act under Article 8(1); otherwise the procedures for class II |
- Open-source software listed in Annex III may use any procedure under Article 32(1), including module A, if the technical documentation is publicly available when the product is placed on the market (Article 32(5)).
- Conformity assessment fees are reduced proportionately for micro, small and medium-sized enterprises (Article 32(6)).
- Conformity assessment bodies can be notified from 11 June 2026 (Article 71(2)).
What already applies – from 11 September 2026?
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products. Reports are submitted through the single reporting platform (ENISA) to the competent CSIRT.
| Step | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | within 24 hours | within 24 hours |
| Notification | within 72 hours | within 72 hours |
| Final report | no later than 14 days after a corrective measure is available | within one month |
The obligation also applies to products placed on the market before 11 December 2027 (Article 69(3)). Details in CRA vulnerability reporting.
What must be in place by 11 December 2027?
- essential requirements of Annex I – part I (product properties) and part II (vulnerability handling);
- a cyber security risk assessment of the product;
- a software bill of materials (SBOM);
- a defined support period – generally at least five years;
- technical documentation (Annex VII);
- conformity assessment – for important and critical products possibly with a notified body;
- EU declaration of conformity and CE marking.
What are the penalties under the CRA?
For infringements of the essential requirements and of the obligations in Articles 13 and 14: up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher (Article 64).
How do we help manufacturers?
Classification of products and roles
Which products are in scope, which category they fall into, and whether you are a manufacturer, importer or distributor.
Now: vulnerability and incident reporting
A reporting process, a coordinated vulnerability disclosure (CVD) policy and a contact point for reports.
Gap analysis against Annex I
Comparison of the product and the development process with the essential requirements, and an action plan to 11 December 2027.
SBOM and vulnerability management in development
Linked to ISO/IEC 27001 (A.8.8, A.8.25–A.8.29) and to IEC 62443-4-1 for industrial products.
Technical documentation and conformity assessment
Preparing the Annex VII documentation, the EU declaration of conformity and the path to the CE marking.
How does the CRA relate to ISO 27001?
An information security management system governs the organisation; the CRA governs the product. The shared processes are vulnerability management, secure development, suppliers and incidents – so we set them up once and use them for both. More on ISO/IEC 27001 implementation.
Who is competent for the CRA in Slovenia?
The central point for implementing the CRA is URSIV, the Government Information Security Office (Certification and Compliance Division). Reports of vulnerabilities and severe incidents from manufacturers established in Slovenia are received by SI-CERT as the coordinator for coordinated vulnerability disclosure. Supervision of products on the market is carried out by the market surveillance authority designated by national implementing legislation.
Frequently asked questions about the CRA
Does the CRA apply to SaaS?
Pure SaaS is generally out of scope. The exception is a remote data processing solution that is part of a product with digital elements – for example a cloud service without which a device cannot perform its function.
Does the CRA also apply to products already on the market?
For the reporting obligation, yes. Under Article 69(3), the obligation to report actively exploited vulnerabilities and severe incidents applies from 11 September 2026 also to products placed on the market before 11 December 2027.
What about open-source software?
Open-source software that is not made available in the course of a commercial activity is outside the scope of the regulation. If you integrate open-source components into your product, you are responsible for the product as a whole as its manufacturer: when integrating third-party components, including open-source ones, you must exercise due diligence, include them in the SBOM and in vulnerability management, and report any vulnerability you discover in a component to whoever maintains it (Article 13). Open-source software stewards – legal persons that provide sustained support for the development of open-source products intended for commercial activities – have limited obligations: a documented cybersecurity policy, cooperation with market surveillance authorities and a limited reporting obligation (Article 24).
What does the CRA require from importers and distributors?
An importer may place on the market only a product for which the manufacturer has carried out the conformity assessment and drawn up the technical documentation; the product must bear the CE marking and be accompanied by the EU declaration of conformity and instructions (Article 19). Before making a product available, a distributor checks the CE marking and the documents of the manufacturer or importer (Article 20). On becoming aware of a vulnerability, both must inform the manufacturer without undue delay and, where there is a significant cybersecurity risk, immediately also the market surveillance authorities. The importer keeps the EU declaration of conformity for at least 10 years or until the end of the support period, if that is longer. Anyone who places a product on the market under their own name or trademark, or substantially modifies it, takes on the obligations of a manufacturer (Article 21).
Do we need a certificate?
The manufacturer carries out the conformity assessment, draws up the EU declaration of conformity and affixes the CE marking. For important and critical products, the conformity assessment may involve a notified body. An ISO/IEC 27001 certificate is not a requirement, but it is a good basis for the processes the CRA requires.
Sources
- Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (CRA), Articles 13, 14, 19–21, 24, 32, 64, 69 and 71 – EUR-Lex
- gov.si – Coordinated vulnerability disclosure and the European vulnerability database (1 July 2025, in Slovenian)
- URSIV – Certification and Compliance Division (in Slovenian)
Last updated: · Prepared by the Regulus Ai team
Is your product in scope of the CRA, and what should you do first?
Check the scope