Cyberpediaby Brain
ENDEFR

The Cyber Resilience Act

EU Regulation 2024/2847 sets cybersecurity rules for makers of digital products: what it changes for you as an employee.

In 30 seconds

Where it happens
In products with digital elements, whether hardware or software1.
What the text wants
To reduce the low level of cybersecurity in many products and the lack of timely security updates1.
The reflex
Before buying or installing a connected product, ask the supplier how it handles vulnerabilities and updates. CE marking under the CRA will come later, with the main obligations applying from 11 December 20271.
If it is already done
A product whose manufacturer does not answer questions about its updates should be reported to the IT or purchasing department before any use.

What it is

A smartwatch, a baby monitor, an app or a desktop program: all these products can carry a security risk that their users struggle to see. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, aims to ensure that devices and software are designed, updated and maintained in a way that protects those who use them1.

The text is addressed first to manufacturers. Yet what manufacturers must do changes what the company can buy, how it can compare its suppliers and what it can ask of them.

Straight answers

What is the Cyber Resilience Act?

It is a European regulation that sets mandatory cybersecurity requirements for manufacturers of products with digital elements. It covers the planning, design, development and maintenance of these products1.

Who is affected?

The regulation protects consumers and businesses that buy software or hardware with digital elements1. The obligations fall on manufacturers and must be met at every stage of the value chain1. The Commission's page also states that manufacturers located throughout the supply chain carry a security responsibility1.

How do you recognise a compliant product?

Products will bear the CE marking to show that they meet the requirements of the regulation1. National market surveillance authorities will ensure that the rules are applied1.

Is the regulation already in force?

It entered into force on 10 December 20241. The reporting obligations apply from 11 September 2026 and the main obligations from 11 December 20271.

Must a high-risk product be checked by a third party?

Certain products that are particularly important for cybersecurity may have to undergo an assessment by a notified body, a third party, before being sold on the Union market1.

1What it changes for employees1 min

The regulation gives the ordinary employee no task. Its effect is indirect: the Commission explains that consumers and businesses find it hard to know which products are secure and to configure them correctly, and that the CRA is meant to make it easier to identify products with the right cybersecurity features1.

Prefer objects and software approved by the company over a connected product bought or installed on your own initiative. Accept the updates offered, since the lack of timely updates is one of the problems the text seeks to correct1. Reporting to your IT department a product that no longer receives patches remains common-sense advice, not an obligation under the regulation. The CRA's reporting obligations target manufacturers1.

2What it changes for managementManagement1 min

For purchasing, products will bear the CE marking1: management will be able to make it a checking criterion as the text comes to apply. It can also ask suppliers how they manage vulnerabilities throughout the life of the product, since the regulation requires this of manufacturers1.

The sources cited here do not detail the roles of manufacturer, importer or distributor; management with questions on this point should read the legal text and the practical guide published by the Commission on 27 July 2026, intended for manufacturers, developers and businesses of all sizes1.

American frameworks describe the same movement and can serve as a basis for discussion with a supplier. On the buyer side, CISA publishes a guide, "Secure by Demand", designed to be used by any software customer in purchasing discussions with resellers or service providers2. It expects products to be secure out of the box, with multifactor authentication, logging and single sign-on available at no extra cost2.

NIST's SSDF framework is a set of secure development practices. It offers a common language that lets software producers and their buyers talk to each other better in purchasing3. Its practices are divided into four groups: prepare the organization, protect the software, produce well-secured software and respond to vulnerabilities3. NIST states that this framework is not a checklist to tick off3.

3What the text saysOfficial text1 min

The CRA imposes mandatory cybersecurity requirements on manufacturers, from planning to maintenance of the product1. Manufacturers must handle vulnerabilities throughout the life cycle of their products1. An assessment by a notified body may be required for certain products1.

CE marking will attest conformity1. National market surveillance authorities will enforce the rules1. The CRA builds on the Union's 2020 cybersecurity strategy and on the security union strategy, and complements the NIS2 directive1.

The Commission keeps separate pages on manufacturers, Member States, conformity assessment, micro and small enterprises, open source software, standardisation and reporting obligations1. They were not read for this article.

4Where implementation stands1 min
  • 10 December 2024: the regulation enters into force1.
  • 27 July 2026: the Commission publishes a practical guide to help manufacturers, developers and businesses of all sizes meet their obligations1.
  • 11 September 2026: reporting obligations begin. Manufacturers must report actively exploited vulnerabilities1.
  • 11 December 2027: the main obligations apply1.

The Commission's page was last updated on 7 September 20261. A product placed on the market today is therefore not yet subject to all the main obligations, which apply only from December 20271.

CISA and 17 American and international partners have published an update to their "Secure by Design" principles, whose initial edition dates from April 20234. These principles are: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top4. These are recommendations4.

Fact sheet

Identifier
CP-370
Wing
6. Governance and GRC
Brain skill
Safeguarding Data (safeguard_data)
Brain reflex
cr-035
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
4 sources checked on 3 November 2026
Sources4 sources
  1. European Commission, “Cyber Resilience Act”, 7 September 2026. https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act (accessed 3 November 2026)
  2. CISA, “Secure by Design | CISA”. https://www.cisa.gov/securebydesign (accessed 3 November 2026)
  3. NIST, “Secure Software Development Framework | CSRC”, 6 October 2026. https://csrc.nist.gov/projects/ssdf (accessed 3 November 2026)
  4. CISA, “Secure-by-Design | CISA”, 25 October 2023. https://www.cisa.gov/resources-tools/resources/secure-by-design (accessed 3 November 2026)

Cite this article

Brain, “The Cyber Resilience Act”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained/

BibTeX 
@misc{brain_cp370_en_2026,
  author = {Brain},
  title = {The Cyber Resilience Act},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/cyber-resilience-act-cra-explained/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence