The CRA in 5 minutes: what a manufacturer must know
No jargon: what the law is, whether it applies to your company, what you have to do and by when. If your boss sent you a task to “sort out the CRA”, start here.
What is the CRA?
The Cyber Resilience Act is an EU regulation (2024/2847). Products with software sold in the EU must stay secure for as long as the manufacturer supports them, and the manufacturer must react quickly to holes found in them.
It is a regulation, so it applies directly in every EU country.
Does it apply to my company?
Yes, if you sell in the EU a device with software (e.g. a thermostat, till, controller, camera), software installed at customers or an app for your device. Products already on sale count too.
There is no exemption for small companies. Medical devices, cars, aviation and pure cloud services (SaaS), among others, have their own rules and are outside the CRA.
What do I have to do now (from 11 September 2026)?
Report holes in your products that attackers are already exploiting, and severe security incidents. Deadlines: early warning within 24 hours, notification with details within 72 hours, final report within 14 days after a fix is available (for incidents: within a month).
Reports go through the ENISA platform (the EU cybersecurity agency) and also reach the national CSIRT. You also have to tell your customers what to do.
To make 24 hours you first need to know that the hole is in your product. That takes a list of your product’s components and a daily check of vulnerability databases. Meldora does that.
What do I have to do by 11 December 2027?
Meet the full requirements: security by design, vulnerability handling for the whole support period (usually at least 5 years), free security updates, a component list (SBOM) in the technical documentation, a declaration of conformity and the CE mark.
Without this you cannot place the product on the EU market from December 2027.
What are the risks?
Fines up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, and a possible order to withdraw the product.
Micro and small companies are not fined just for missing the 24-hour early warning, but all other duties apply in full. In practice a customer or tender asking “show us how you handle vulnerabilities” often hurts sooner than a fine.
Six words worth knowing
Vulnerability (hole): a software flaw through which the product can be attacked.
SBOM: the product’s ingredient list, the ready-made software it is built from.
Actively exploited: attackers already use the hole; only then do you have to report.
CVSS: a 0–10 score of how dangerous a hole is (critical, high, medium, low).
ENISA: the EU cybersecurity agency that runs the reporting platform.
Support period: how long you promise customers security updates.
Where to start?
1. List the products you sell in the EU and who knows their software (a developer, a supplier).
2. Decide who in the company receives urgent alerts, also at weekends.
3. Book a 30-minute call: I’ll tell you what applies to you and set up a portal account with your products.
A 30-minute call, no commitment.