Cyber Resilience Act

The CRA sets mandatory cybersecurity requirements for products with digital elements sold in the EU — secure-by-design, vulnerability handling, and incident reporting across the whole product lifecycle.

In practice that means building security in from the start, then proving it: a technical file and an EU Declaration of Conformity, CE marking, a coordinated vulnerability-disclosure process and an SBOM, and active reporting of exploited vulnerabilities — evidenced from design through the end of the support period.

Who must comply: Anyone making, importing or distributing products with digital elements on the EU market. A few product classes under their own regimes — medical devices, vehicles, aviation — and pure SaaS sit largely outside scope.

• Secure-by-design — no known exploitable vulnerabilities at release
• Vulnerability handling, a CVD policy and an SBOM
• Article 14 reporting of actively exploited vulnerabilities