[Home](/)/[Resources](/resources)/EU Cyber Resilience Act EUCybersecurity # EU Cyber Resilience Act: Cybersecurity Requirements for Connected Hardware Products The Cyber Resilience Act is the EU's first horizontal cybersecurity law for products. It covers everything from smart home sensors to industrial gateways — and it requires manufacturers to take security seriously before a product ships, not after. If your hardware connects to a network or processes data, this regulation applies to you. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Feu-cyber-resilience-act) At a glance Regulation (EU) 2024/2847 CRA Enforcement December 11 2027 Incident reporting 24h to ENISA Classes Default · Class I · Class II · Critical ## What the CRA requires ### Scope: products with digital elements The CRA applies to any product that has software or hardware components capable of connecting to networks or other devices. Most IoT hardware, smart consumer electronics, and connected industrial devices are in scope. Purely analogue hardware with no network or data-processing capability is excluded. ### Risk classification Products fall into four categories. Default covers the majority of connected products and allows self-assessment. Important Class I (Annex III) covers products whose core function is security-relevant — operating systems, browsers, password managers, VPNs, routers and switches, and smart home products with security functions such as smart locks and security cameras; self-assessment is allowed only if harmonised standards are applied in full, otherwise a notified body is needed. Important Class II covers hypervisors, firewalls and intrusion detection systems, and tamper-resistant microprocessors and microcontrollers, and always requires third-party assessment. Critical products (Annex IV) — hardware devices with security boxes such as HSMs, smart meter gateways, and smartcards or secure elements — also require third-party assessment, with European cybersecurity certification (EUCC) where a Commission delegated act requires it. ### Essential cybersecurity requirements Products must be secure by default, ship without known exploitable vulnerabilities, and support security updates for the expected product lifetime. Manufacturers must provide a software bill of materials (SBOM) and maintain a documented vulnerability disclosure procedure. Products must also protect the confidentiality and integrity of data they store, transmit, or process. ### Vulnerability notification Manufacturers must notify ENISA within 24 hours of becoming aware of an actively exploited vulnerability in their product. A more detailed incident report is required within 72 hours. This notification obligation applies throughout the product's support lifetime, not just at the point of first sale. ## How to achieve CRA compliance 01 Determine whether your product is a 'product with digital elements' in CRA scope — products that process data or connect to devices or networks are in scope; purely analogue hardware without any software component is excluded. 02 Classify your product as Default, Class I, Class II, or Critical using Annexes III and IV of the CRA — check whether your product's core function matches any of the listed higher-risk categories such as VPNs, routers, firewalls, or hypervisors; most general consumer electronics fall into the Default class. 03 Conduct a cybersecurity risk assessment and implement the essential requirements from Annex I, Part I — this includes secure-by-default configuration, minimising the attack surface, and protecting the confidentiality and integrity of data. 04 Prepare the technical documentation package including the cybersecurity risk assessment, vulnerability disclosure policy, software composition analysis or SBOM, and end-user instructions for applying security updates. 05 Follow the correct conformity assessment route: Default class products use internal control (Module A); Class I products can use Annex VIII self-declaration only if harmonised standards are applied in full, otherwise third-party assessment; Class II and Critical products require third-party assessment (a notified body, or EUCC certification where it applies) before placing the product on the market. ## Frequently asked questions ### When does the CRA start applying to products? The CRA entered into force in December 2024. The vulnerability reporting obligations to ENISA apply from September 2026. The full product requirements — including essential cybersecurity requirements and conformity assessment — apply from December 11, 2027. Products placed on the market before that date do not have to meet the product requirements unless they are substantially modified afterwards, but the vulnerability and incident reporting obligations apply to them from September 2026. ### Does the CRA replace the RED delegated act on cybersecurity? No — these are parallel obligations. The RED delegated regulation (EU) 2022/30 applies specifically to radio equipment and covers Articles 3(3)(d)(e)(f) of the Radio Equipment Directive. The CRA applies to products with digital elements more broadly. A connected radio product may need to satisfy both. Compliance with CRA essential requirements may, however, contribute to satisfying the RED cybersecurity obligations where the scope overlaps. ### What is an SBOM and is it mandatory under the CRA? A software bill of materials (SBOM) is a machine-readable inventory of all software components in a product, including open-source libraries, their versions, and known vulnerabilities. The CRA requires manufacturers to identify and document all components in their products, and the SBOM is the standard mechanism for meeting this obligation. It must be maintained throughout the product's support period and updated when components change. ### Do firmware updates count as new products under the CRA? Substantial modifications to a product that change its intended purpose or introduce new risks may trigger re-assessment under the CRA. Minor security patches and bug fixes do not constitute a new product. Manufacturers should define a clear change-management process to assess whether a given firmware update requires a new or updated conformity assessment before release. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇪🇺 CE Marking roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇪🇺 CE Marking compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $199](/courses/40-eu-cyber-resilience-act-cra-connected-products)[Prefer to read? Get the book — $24.99](/books/40-eu-cyber-resilience-act-cra-connected-products) Related guides * [EU RED CybersecurityEU RED cybersecurity delegated regulation: network protection, personal data safeguards, and anti-fraud measures for radio equipment with internet connectivity or financial functions.](/guides/eu-radio-equipment-directive-cybersecurity) * [EU AI Act HardwareEU AI Act implications for hardware makers: high-risk AI system classification, notified body conformity assessment, CE marking, and embedded AI component obligations.](/guides/eu-artificial-intelligence-act-hardware) * [EU REACH SVHCEU REACH SVHC for electronics: ECHA candidate list substances, 0.1% w/w threshold in articles, SCIP database notification, and supply chain communication obligations.](/guides/eu-reach-svhc-electronics) * [EU GPSREU Regulation (EU) 2023/988 GPSR replaced the GPSD in December 2024: new traceability rules, online marketplace duties, digital product identifiers, and the SAREF rapid-alert notification obligation.](/guides/eu-gpsr-general-product-safety)