Until now, the EU had hardly any general security requirements for software and connected devices. The CRA changes that: from December 11, 2027, such products may only be placed on the market if they meet essential cybersecurity requirements, demonstrated by the CE marking, similar to electrical safety. The regulation entered into force on December 10, 2024, and applies directly in all member states, without a national implementing act.
Who does the CRA apply to?
It covers manufacturers, importers, and distributors of products with digital elements: from routers and webcams to smart home devices and industrial controllers to operating systems, apps, and desktop software. Remote data processing, such as a cloud service, is covered only to the extent that the product needs it for its functions. Areas with their own rules are excluded, for example medical devices, in vitro diagnostics, motor vehicles, aviation, marine equipment, and products used exclusively for national security or defense. Organizations that maintain open-source software on an ongoing basis without being manufacturers have their own, lighter role as open-source stewards.
What obligations do manufacturers have?
- Security from the start: Risk assessment and secure design, development, and production in accordance with Annex I.
- Handle vulnerabilities: Document components, among other things with a software bill of materials (SBOM), fix vulnerabilities without delay, and provide security updates separately from feature updates where possible.
- Coordinated disclosure: Establish a policy for coordinated vulnerability disclosure and provide a contact address for reports.
- Support period: Handle vulnerabilities for at least five years, unless the product is expected to be in use for a shorter time. Security updates that have been provided must remain available for at least ten years.
- Conformity and CE marking: For most products, a self-assessment is sufficient. Stricter procedures apply to important and critical products, such as firewalls.
Reporting obligations since September 11, 2026
Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents through ENISA's single reporting platform, simultaneously to the competent CSIRT and ENISA. The deadlines: early warning within 24 hours, notification within 72 hours, and a final report no later than 14 days after a corrective measure is available for vulnerabilities, or within one month for incidents. The obligation also applies to products already on the market before December 2027. The remaining obligations apply from December 11, 2027.
In practice for SMEs and municipalities
- As a buyer: When purchasing new devices and software, ask about the support period, the point of contact for vulnerabilities, and CE conformity. This helps with municipal tenders as much as in companies.
- As a manufacturer: If you sell software or connected devices, even as a small company, you need an orderly security process by December 2027. The reporting obligation is already in effect.
- In combination with NIS2: NIS2 governs the security of entities, the CRA that of products. Many companies are affected by both. The reporting deadlines under NIS2 and the NISG 2026 (Austrian Network and Information Systems Security Act 2026) are summarized in the download NIS2 reporting obligations.
Penalties
Infringements of the essential requirements or the obligations under Art. 13 and 14 can be punished with fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
How TOMORIS relates
TOMORIS NEXT Development builds permission and security concepts into planning from the start. This entry is a general overview and does not replace legal advice.