Who it applies to
The CRA applies to manufacturers, importers and distributors of hardware and software products with digital elements. In force since December 2024, it requires reporting of actively exploited vulnerabilities from 11 September 2026 and applies in full from 11 December 2027.
The main obligations
Security by design, risk assessment, vulnerability handling throughout the support period, security updates, technical documentation and a software bill of materials (SBOM), CE marking.
How to prepare
- List products with digital elements and their class.
- Introduce a secure development lifecycle and vulnerability management.
- Produce and maintain product SBOMs.
- Set up the process for reporting exploited vulnerabilities.
- Test products with penetration testing before release.
Explore further with Eulogic NT
Let’s discuss how these topics apply to your organisation.