The Cyber Resilience Act (CRA) is the EU’s new regulation aiming to make digital products — both hardware and software — more secure by design and throughout their lifecycle. It applies to nearly every connected product on the EU market, from smart fridges to SaaS platforms.
Learn moreThe EU adopts technical descriptions of the categories of products with digital elements
You need to carry out your reporting obligations for actively exploited vulnerabilities and severe incidents
If your product is considered a “high-risk product”, you need a notified body for an external conformity assessment.
All your products with digital elements are regulated by the CRA now and need to fulfill the essential cybersecurity requirements and declare conformity.
The CRA introduces a two-tier system for “important” products with digital elements—Class I and Class II—as defined in Article 7 and detailed in Annex III of the regulation. Understanding the distinction is crucial because it determines the type of conformity assessment required.
Learn moreCommercial manufacturers are held legally liable for the security of all open source software embedded in their devices.
If you choose to build your own infrastructure, such as a home-grown over-the-air (OTA) update system, you assume legal responsibility for continuous vulnerability tracking, mandatory SBOM generation, and strict exploit reporting timelines.
Managing this overhead in-house is a massive operational risk for a lot of engineering teams.
We’ve co-sponsored the 2026 Cyber Resilience Act (CRA) Awareness and Readiness Report, produced by The Linux Foundation and the Open Source Security Foundation (OpenSSF).
Read the report
Take the Linux Foundation’s LFEL1001 Training Course Understanding the EU Cyber Resilience Act (CRA) (LFEL1001), which is a free 60-90 minute express training designed to explain the CRA in plain terms.
Take the free CRA trainingUnder the CRA, handling vulnerabilities isn’t just good practice, it’s the law. Manufacturers have to detect, document, fix, and report exploited vulnerabilities within 24 hours (!), plus submit final reports in just 14 days. Oh, and notify users too, preferably in a machine-readable format.
One of the goals of the Cyber Resilience Act is to make sure that both hardware and software products have fewer vulnerabilities when they are sold and that manufacturers manage security throughout the product's entire life. This includes designing and developing products securely and handling any vulnerabilities that are discovered after the product is on the market.
Under the CRA, manufacturers must be able to identify and account for every component in their products, including third-party libraries, system dependencies, and embedded software. This level of visibility is essential not only for compliance, but also for building trust with customers and partners.
The CRA doesn’t stop at product launch—it follows you through the entire lifecycle. From first deployment to final shutdown, manufacturers are expected to maintain security support and clearly communicate when that support ends. That means planning for updates, defining an End-of-Life (EOL) policy, and ensuring devices don’t become vulnerabilities once they’re out of service.
If your product relies on remote services to function—like cloud dashboards, update systems, or device management—you’re also responsible for securing that infrastructure. The CRA treats these remote data processing components as part of your product, meaning they must meet the same cybersecurity standards. Ensuring confidentiality, integrity, and availability across your backend is just as critical as securing the device itself
.webp)