--- id: CP-370 slug: cyber-resilience-act-cra-explained lang: en title: The Cyber Resilience Act description: "EU Regulation 2024/2847 sets cybersecurity rules for makers of digital products: what it changes for you as an employee." canonical_url: https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained/ markdown_url: https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "The Cyber Resilience Act", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained/ (CC BY 4.0) wing: 6 theme: safeguard_data reflex: cr-035 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained/ fr: https://startbrain.io/cyberpedia/fr/articles/cyber-resilience-act-cra/ de: https://startbrain.io/cyberpedia/de/articles/cyber-resilience-act-cra-de/ es: https://startbrain.io/cyberpedia/es/articles/reglamento-ciberresiliencia-cra/ sources: - "n": 1 title: Cyber Resilience Act publisher: European Commission url: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act published: "2026-09-07" accessed: "2026-11-03" - "n": 2 title: Secure by Design | CISA publisher: CISA url: https://www.cisa.gov/securebydesign accessed: "2026-11-03" - "n": 3 title: Secure Software Development Framework | CSRC publisher: NIST url: https://csrc.nist.gov/projects/ssdf published: "2026-10-06" accessed: "2026-11-03" - "n": 4 title: Secure-by-Design | CISA publisher: CISA url: https://www.cisa.gov/resources-tools/resources/secure-by-design published: "2023-10-25" accessed: "2026-11-03" --- # The Cyber Resilience Act A smartwatch, a baby monitor, an app or a desktop program: all these products can carry a security risk that their users struggle to see. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, aims to ensure that devices and software are designed, updated and maintained in a way that protects those who use them [1]. The text is addressed first to manufacturers. Yet what manufacturers must do changes what the company can buy, how it can compare its suppliers and what it can ask of them. ## In 30 seconds - Where it happens: in products with digital elements, whether hardware or software [1]. - What the text wants: to reduce the low level of cybersecurity in many products and the lack of timely security updates [1]. - The reflex: before buying or installing a connected product, ask the supplier how it handles vulnerabilities and updates. CE marking under the CRA will come later, with the main obligations applying from 11 December 2027 [1]. - If it is already done: a product whose manufacturer does not answer questions about its updates should be reported to the IT or purchasing department before any use. ## Straight answers ### What is the Cyber Resilience Act? It is a European regulation that sets mandatory cybersecurity requirements for manufacturers of products with digital elements. It covers the planning, design, development and maintenance of these products [1]. ### Who is affected? The regulation protects consumers and businesses that buy software or hardware with digital elements [1]. The obligations fall on manufacturers and must be met at every stage of the value chain [1]. The Commission's page also states that manufacturers located throughout the supply chain carry a security responsibility [1]. ### How do you recognise a compliant product? Products will bear the CE marking to show that they meet the requirements of the regulation [1]. National market surveillance authorities will ensure that the rules are applied [1]. ### Is the regulation already in force? It entered into force on 10 December 2024 [1]. The reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027 [1]. ### Must a high-risk product be checked by a third party? Certain products that are particularly important for cybersecurity may have to undergo an assessment by a notified body, a third party, before being sold on the Union market [1]. ## What it changes for employees The regulation gives the ordinary employee no task. Its effect is indirect: the Commission explains that consumers and businesses find it hard to know which products are secure and to configure them correctly, and that the CRA is meant to make it easier to identify products with the right cybersecurity features [1]. Prefer objects and software approved by the company over a connected product bought or installed on your own initiative. Accept the updates offered, since the lack of timely updates is one of the problems the text seeks to correct [1]. Reporting to your IT department a product that no longer receives patches remains common-sense advice, not an obligation under the regulation. The CRA's reporting obligations target manufacturers [1]. ## What it changes for management For purchasing, products will bear the CE marking [1]: management will be able to make it a checking criterion as the text comes to apply. It can also ask suppliers how they manage vulnerabilities throughout the life of the product, since the regulation requires this of manufacturers [1]. The sources cited here do not detail the roles of manufacturer, importer or distributor; management with questions on this point should read the legal text and the practical guide published by the Commission on 27 July 2026, intended for manufacturers, developers and businesses of all sizes [1]. American frameworks describe the same movement and can serve as a basis for discussion with a supplier. On the buyer side, CISA publishes a guide, "Secure by Demand", designed to be used by any software customer in purchasing discussions with resellers or service providers [2]. It expects products to be secure out of the box, with multifactor authentication, logging and single sign-on available at no extra cost [2]. NIST's SSDF framework is a set of secure development practices. It offers a common language that lets software producers and their buyers talk to each other better in purchasing [3]. Its practices are divided into four groups: prepare the organization, protect the software, produce well-secured software and respond to vulnerabilities [3]. NIST states that this framework is not a checklist to tick off [3]. ## What the text says The CRA imposes mandatory cybersecurity requirements on manufacturers, from planning to maintenance of the product [1]. Manufacturers must handle vulnerabilities throughout the life cycle of their products [1]. An assessment by a notified body may be required for certain products [1]. CE marking will attest conformity [1]. National market surveillance authorities will enforce the rules [1]. The CRA builds on the Union's 2020 cybersecurity strategy and on the security union strategy, and complements the NIS2 directive [1]. The Commission keeps separate pages on manufacturers, Member States, conformity assessment, micro and small enterprises, open source software, standardisation and reporting obligations [1]. They were not read for this article. ## Where implementation stands - 10 December 2024: the regulation enters into force [1]. - 27 July 2026: the Commission publishes a practical guide to help manufacturers, developers and businesses of all sizes meet their obligations [1]. - 11 September 2026: reporting obligations begin. Manufacturers must report actively exploited vulnerabilities [1]. - 11 December 2027: the main obligations apply [1]. The Commission's page was last updated on 7 September 2026 [1]. A product placed on the market today is therefore not yet subject to all the main obligations, which apply only from December 2027 [1]. CISA and 17 American and international partners have published an update to their "Secure by Design" principles, whose initial edition dates from April 2023 [4]. These principles are: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top [4]. These are recommendations [4]. ## Sources 1. European Commission, "Cyber Resilience Act", 7 September 2026. https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act (accessed 3 November 2026) 2. CISA, "Secure by Design | CISA". https://www.cisa.gov/securebydesign (accessed 3 November 2026) 3. NIST, "Secure Software Development Framework | CSRC", 6 October 2026. https://csrc.nist.gov/projects/ssdf (accessed 3 November 2026) 4. CISA, "Secure-by-Design | CISA", 25 October 2023. https://www.cisa.gov/resources-tools/resources/secure-by-design (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.