Knowledge · Cyber Resilience Act

CRA Insights

Knowledge on the Cyber Resilience Act

Evidence-based, up-to-date analyses on scope, deadlines, SBOM, product classes, roles and industry-specific guidance for the EU Cyber Resilience Act (Reg. (EU) 2024/2847).

Kontakt aufnehmen

Cyber Resilience Act: Am I Affected?

Manufacturer, importer or distributor: who falls under the CRA and who does not? Products with digital elements plus exceptions like medical and automotive.

CRA Reporting Obligation since 11 September 2026: What Manufacturers Must Have in Place Now

What manufacturers must have ready since 11 Sep 2026: the ENISA Single Reporting Platform, a PSIRT and a 24-hour early warning process. Check where you stand.

Cyber Resilience Act for SMEs: What Manufacturers Need to Do Now

No size exemption, but clear priorities: what SME makers tackle first - reporting before SBOM before CE marking. A prioritised CRA roadmap to start today.

SBOM Requirements under the Cyber Resilience Act: Formats, Contents and Archiving

What a CRA-compliant software bill of materials must contain, which format - CycloneDX or SPDX - to choose and how the 10-year archiving duty applies.

CRA Product Classes: How Is Your Product Classified - and What Does That Mean?

Class I in-house only if harmonised standards, common specifications or an EU certification scheme are fully applied (Art. 32(2)), otherwise Module B+C or H.

CRA Penalties & Fines: what Article 64 actually provides for

CRA penalties under Article 64: up to €15m or 2.5% of annual turnover. The three fine tiers and how far the Article 64(10) exceptions reach, explained.

CRA vs. NIS2 vs. DORA: different subjects of regulation, sometimes the same companies

CRA, NIS2 and DORA compared: the CRA regulates products, NIS2 organisations, DORA finance. See clearly who is subject to which regime and where they overlap.

Vulnerability Handling, Reporting & CVD under the CRA

Vulnerability handling, reporting and coordinated disclosure under the CRA: the 24h, 72h and final-report cascade - in force since 11 Sep 2026.

CRA Deadlines 2024-2027: The Staggered Timeline

All CRA deadlines 2024 to 2027 at a glance: entry into force, reporting since 11 Sep 2026, full application on 11 Dec 2027. What each date means for you.

Conformity Assessment and CE Marking under the Cyber Resilience Act

Conformity assessment under the CRA: Module A, B+C or H, when a notified body is required and how CE marking and the EU declaration of conformity fit in.

The Cyber Resilience Act and Open Source: The Steward Role and Scope

How does the CRA treat open source? Non-commercial FOSS is outside scope, open-source stewards (Art. 24) face a light regime, and makers stay responsible.

Roles under the CRA: Manufacturer, Importer and Distributor at a Glance

Who bears which duty under the CRA? Manufacturer (Art. 13), importer (Art. 19), distributor (Art. 20) and authorised representative (Art. 18), with a matrix.

Technical Documentation and EU Declaration of Conformity under the CRA

What CRA technical documentation must contain (Annex VII), how the EU declaration of conformity is structured and why you retain it all for 10+ years.

Cyber Resilience Act for IoT, Embedded & Smart Products

CRA orientation for makers of IoT, embedded and smart products: RED transition, product classes, duties and deadlines to 11 Dec 2027. Not legal advice.

Cyber Resilience Act for Machinery & Industrial Automation

The CRA for machinery: deadlines to 11 Dec 2027, product classes, overlap with the Machinery Regulation, SBOM and a practical roadmap for controls.

Cyber Resilience Act and Medical Technology: the Scope Boundary

MDR/IVDR medical devices are exempt from the CRA (Art. 2(2)) - wellness, fitness and hospital IT without a medical purpose are not. How to draw the line.

Cyber Resilience Act for Software & SaaS Makers

CRA for software makers: standalone software is in scope, SaaS only as remote data processing of a product. NIS2 may apply to cloud services by company size.

CRA Glossary - the Central Terms of the Cyber Resilience Act

The Cyber Resilience Act made clear: product with digital elements, Annex III/IV, conformity assessment, modules, SBOM and reporting - 27 terms defined.

Distributor Duties under the CRA (Art. 20): Due Care in the Supply Chain

What does a distributor owe under the CRA? Due care under Art. 20: verify CE marking, check manufacturer and importer duties, act on non-conformity.

Manufacturer Duties under the CRA: What Art. 13 Really Requires

Manufacturers carry the main burden under the CRA: essential requirements, vulnerability handling, technical docs, conformity assessment, CE and reporting.

Importer Duties under the CRA (Art. 19): the Gatekeeper to the EU Market

The importer as gatekeeper to the EU market: which duties does it bear under Art. 19 of the CRA? Verify, don't manufacture - conformity, technical docs, CE.

CRA risk assessment & threat modeling

The CRA risk assessment belongs in the technical documentation: how STRIDE, attack trees and data-flow diagrams deliver the Annex I / Art. 13 evidence.

CRA support period, EOL & update duty

How long must a product get security updates under the CRA? Support period of at least 5 years, end date, EOL planning and the update duty.

CRA × NIS2 × DORA × AI Act: the convergence

How the CRA, NIS2, DORA and AI Act interact: product vs. operations vs. finance vs. AI use - the multi-regulation map for manufacturers. Map your duties now.

Implementing security-by-design in the CRA

Security-by-design and security-by-default per Annex I of the CRA: the concrete requirements, a secure development lifecycle and implementation levers.

What does CRA compliance cost?

CRA compliance cost depends on product class, SBOM maturity and process maturity. The cost drivers and three illustrative effort scenarios. Estimate it now.

Cyber Resilience Act: what management needs to know now

Cyber Resilience Act for management: scope, deadlines to 2027, reporting since 11 Sep 2026, six areas for decision and the consequences of infringements.

Who is liable for CRA infringements? Company, management and product liability

Who is liable for CRA infringements? Fines under Article 64 CRA and the OWiG, internal liability of management, product liability: three levels explained.

Checking CRA readiness: the evidence management should ask for

Checking CRA readiness: which evidence the CRA requires, where it is laid down and how management can tell whether it is reliable. With table and questions.

CRA audit: what it can mean, how it works and what drives the cost

The Cyber Resilience Act does not define a CRA audit. Three kinds compared, plus process, review areas and cost drivers of an independent assessment.

Get in touch

Request a CRA readiness assessment

Gap analysis of current vs. target state against Annex I - concrete, evidence-based and mapped to your product portfolio.

Request an initial call