EU Cyber Resilience Act
The CRA applies in full from 11 December 2027.
Regulation (EU) 2024/2847 sets cybersecurity requirements for products with digital elements placed on the EU market. This page goes through what it asks of a manufacturer, when each part of it applies, and what you work with in Cyberismo for each obligation.
The requirements are lifecycle requirements rather than a document set, which is why they are hard to bolt on at the end. Most of the work is secure development you would want to be doing anyway, kept in a form you can show someone.
The dates to plan around
Two of these matter to most manufacturers: reporting obligations arrive more than a year before the rest of the regulation does.
- 10 Dec 2024
In force
Regulation (EU) 2024/2847 entered into force. The obligations below phase in from there.
- 11 Jun 2026
Notified bodies
Conformity assessment bodies can be notified, so third-party assessment becomes available to book.
- 11 Sep 2026
Reporting starts
The reporting obligations for actively exploited vulnerabilities and severe incidents apply.
- 11 Dec 2027
Full application
Everything else applies. Products placed on the EU market from this date must meet the essential requirements.
Are you in scope, and as what?
The CRA covers products with digital elements made available on the EU market: software, hardware with software in it, and remote data processing solutions that the product depends on. There are carve-outs where other EU law already covers a sector, such as medical devices, motor vehicles and civil aviation.
Your obligations then depend on which role you hold. Manufacturers carry the essential requirements; importers and distributors carry their own, and are treated as the manufacturer when they place a product under their own name or trademark, or modify it substantially. Open-source stewards have a lighter, separate regime.
The product category decides how conformity is assessed, and it is worth settling early, because a third-party route has lead time you cannot compress.
Default category
Most products with digital elements. The manufacturer assesses conformity itself, under internal control.
Important, Class I
Listed in Annex III. Self-assessment is available only if the harmonised standards are applied in full; otherwise a third party is involved.
Important, Class II
Also listed in Annex III, at higher risk. A third-party conformity assessment is required.
Critical
Listed in Annex IV. May be required to hold a certificate under a European cybersecurity certification scheme.
What you have to produce
Eight obligations, and the work each one involves in practice.
A cybersecurity risk assessment for the product
Article 13The risk assessment drives everything else, and it belongs in the technical documentation. In Cyberismo this is the high-level risk assessment and the threat model in Secure Development Essentials, with the data flow diagrams generated from the model rather than drawn beside it.
The essential cybersecurity requirements
Annex I, Part ISecure by design and secure by default, no known exploitable vulnerabilities at release, protection of confidentiality and integrity, data minimisation, a limited attack surface, and a mechanism for security updates. EU CRA Essentials turns each requirement into content you work through, mapped onto the secure development practices underneath it.
Vulnerability handling, for the whole support period
Annex I, Part IIIdentify and document components including an SBOM, address vulnerabilities without delay, test regularly, publish information about fixed vulnerabilities, run a coordinated disclosure policy, and distribute updates securely. Vulnerability and incident management come from ISMS Essentials, and the Dependency-Track connector puts component vulnerabilities from your SBOMs beside the products they affect.
A support period you can defend
Article 13At least five years, unless the product is expected to be in use for less, and the reasoning has to hold up. This is a decision recorded against the product in the same model, with its justification recorded alongside it.
Information and instructions to the user
Annex IIWhat the user has to be told about the product, its support period and how to report a vulnerability. These are controlled documents in the same project, versioned and reviewed like everything else, and they go out with the same export.
Technical documentation
Annex VIICyberismo exports the project as a static site or a PDF, generated from the content as it stands at release. Because the documentation is generated from the work, the two stay consistent.
Reporting actively exploited vulnerabilities and severe incidents
Article 14An early warning within 24 hours, a notification within 72 hours, and a final report after that. Cyberismo does not file these for you. What it gives you is the vulnerability and incident record in one place, so you do not spend the 24 hours gathering information you already have.
Conformity assessment, the EU declaration and CE marking
Annex VIIIWhich route applies depends on your product category. Most products are assessed by the manufacturer under internal control; important and critical products have stricter routes. The evidence the route asks for is what the rest of this page produces.
What Cyberismo does not do
It does not make your product compliant, and it does not replace the engineering. The reasoning engine checks structure and relationships: that required evidence is linked, that a reviewer is not the owner of the document under review, that a control is in scope, that a review happened inside its period. It does not judge whether your threat model is a good threat model, or whether your risk assessment is sound. That still requires expertise.
It does not file your Article 14 reports, and it does not issue your declaration of conformity. Those remain yours to sign.
This page is a summary of the regulation written for engineering and product teams, not legal advice. Where a decision turns on the exact wording, read the regulation itself and take proper advice.
Where to start
Three routes, depending on how much of this you already have. They are not exclusive, and most teams end up doing the first one regardless.
Free
Run the module yourself
Install the tool, import EU CRA Essentials on top of Secure Development Essentials, and work through the essential requirements against one product. The module is open source and free to use.
Browse the modules →With our consultants
CRA kickstart
Scoping across your product portfolio, a current state analysis against the essential requirements, and an implementation roadmap with the work sequenced against the dates. Run by the consultants behind the certification projects on our references page.
About the kickstart →For your team
Learn the regulation
A four-module course taking engineers, product managers and compliance specialists from the regulatory rationale to an implementation roadmap. Self-paced online or instructor-led, and you can preview it before buying.
See the course →Common questions
Does the CRA apply to us if we only sell software?
Probably. The regulation covers products with digital elements placed on the EU market, and software on its own is a product with digital elements. Scope questions turn on what the product is and how it reaches the market, not on whether it ships with hardware.
We are not the manufacturer. Are we still affected?
Possibly as an importer or distributor, which carry their own obligations. An importer or distributor is treated as the manufacturer when the product is placed on the market under their own name or trademark, or when they substantially modify it.
What happens if we are late?
Products that do not meet the essential requirements cannot lawfully be placed on the EU market from 11 December 2027, and the regulation provides for administrative fines. The practical risk most teams meet first is a customer asking for conformity evidence before that date.
Do we need to buy anything from you to start?
No. EU CRA Essentials, Secure Development Essentials and the Cyberismo tool are open source and free to run in production. The subscription modules cover other standards, and the hosted service and the connectors are separate.
Contact
- 01
A short conversation
Thirty minutes on what you are trying to achieve and which standards apply.
- 02
A concrete proposal
Which modules, hosted or self-run, what adoption support you would want, and what it costs.
- 03
You try it first
We recommend that your team tries the open-source version before you buy anything.
Cyberismo is based in Tampere, Finland. We work smoothly with teams anywhere in the world.