01Key dates
The legislative process is complete.
The transition period starts.
Rules on conformity assessment bodies apply.
Reporting of exploited vulnerabilities and severe incidents applies, including products already on the market.
Products must meet all requirements and conformity assessment.
Reporting applies 15 months before full compliance, and it also covers products already on the market.
02Four core duties
Secure by design
Secure-by-default configuration and a smaller attack surface, meeting the Annex I essential requirements.
Vulnerability handling and updates
Fix vulnerabilities and provide security updates through the support period, with a disclosure channel.
Conformity and technical file
Assessment by product class, a technical file, a declaration of conformity and CE marking.
Vulnerability and incident reporting
For exploited vulnerabilities and severe incidents: 24-hour early warning, 72-hour notification, final report.
03Product classes and assessment routes
Most connected products
Operating systems, browsers, VPNs, password managers, routers, general-purpose smart home products
Hypervisors, firewalls, intrusion detection and prevention systems, tamper-resistant microprocessors
Hardware devices with security boxes, smart meter gateways, smart cards
Classification follows Article 7 and Annexes III and IV. Which class a given product falls in depends on the annexes and later implementing acts; confirm with your compliance adviser.
04Harmonised standards
Harmonised standards that turn Annex I into verifiable technical requirements are being developed in Europe. Until they are cited in the Official Journal, industry standards can be used for gap analysis; only full application of a harmonised standard gives a presumption of conformity. Follow the official publication status.
05A seven-step roadmap
- 1Scope and classIn scope? Which class? · free tool →
- 2Annex I gap analysisCheck essential requirements · free tool →
- 3Vulnerability and reportingAlready applies: first
- 4Assessment routeSelf, notified body or EUCC
- 5Technical fileDesign, tests, evidence
- 6Declaration and CESign, then market
- 7Post-market upkeepUpdates, reports, reassessment
Watchpost covers the reporting part
The other steps have until December 2027; reporting already applies. See the readiness checklist and the 24-hour reporting guide. Watchpost does not submit for you and does not provide certification, assessment or technical-file services.
- Keeps watching exploited vulnerabilities against your products
- Starts the 24-hour countdown on a hit and alerts owner and backup
- Drafts the English report for each stage, to review and copy
?FAQ
When does the CRA apply?
It entered into force on 10 December 2024; reporting duties apply from 11 September 2026; full application is 11 December 2027.
Which products does the CRA cover?
Products with digital elements made available on the EU market, generally hardware and software that connects directly or indirectly to other devices or networks, regardless of where the manufacturer is based.
How many product classes does the CRA have?
Four: default, important class I, important class II and critical, each with a different conformity assessment route.
Free 3-minute readiness check
Ten questions, one page you can hand to your boss.
More guides
This article summarises the public text of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) for general information. It is not legal advice; rely on the regulation itself and your own counsel.