Under the CRA, handling vulnerabilities isn’t just good practice,  it’s the law.  Manufacturers have to detect, document, fix, and report exploited vulnerabilities within 24 hours (!), plus submit final reports in just 14 days. Oh, and notify users too, preferably in a machine-readable format.

One of the goals of the Cyber Resilience Act is to make sure that both hardware and software products have fewer vulnerabilities when they are sold and that manufacturers manage security throughout the product's entire life. This includes designing and developing products securely and handling any vulnerabilities that are discovered after the product is on the market.

Under the CRA, manufacturers must be able to identify and account for every component in their products, including third-party libraries, system dependencies, and embedded software. This level of visibility is essential not only for compliance, but also for building trust with customers and partners.

The CRA doesn’t stop at product launch—it follows you through the entire lifecycle. From first deployment to final shutdown, manufacturers are expected to maintain security support and clearly communicate when that support ends. That means planning for updates, defining an End-of-Life (EOL) policy, and ensuring devices don’t become vulnerabilities once they’re out of service.

If your product relies on remote services to function—like cloud dashboards, update systems, or device management—you’re also responsible for securing that infrastructure. The CRA treats these remote data processing components as part of your product, meaning they must meet the same cybersecurity standards. Ensuring confidentiality, integrity, and availability across your backend is just as critical as securing the device itself