Cyber Resilience Act
EU Cyber Resilience Regulation
The European regulation requiring security by design for all products with digital elements. Technical documentation, mandatory SBOM and CE marking.
What you'll find in this guide
What is the Cyber Resilience Act?
The Cyber Resilience Act (CRA) is the European regulation that establishes mandatory cybersecurity requirements for all products with digital elements marketed in the European Union.
It applies to manufacturers, importers and distributors of hardware and software. The guiding principle is 'cybersecurity by design': security must be incorporated from the product design stage, not as an afterthought.
The CRA introduces technical documentation obligations (Annex VII), vulnerability management throughout the product lifecycle, notification of actively exploited vulnerabilities within 24 hours to authorities, and mandatory CE marking for marketing in the EU.
CRA Key Dates
The Cyber Resilience Act implementation timeline
Official publication
The CRA is published in the Official Journal of the EU and enters into force
Notified bodies
CRA certification bodies will be designated and operational
Reporting obligations active
Mandatory 24h reporting of actively exploited vulnerabilities
Full application
All products must meet CRA essential requirements
Key CRA Articles
Each article explained with real practical cases
"Manufacturers shall ensure that products with digital elements are designed, developed and produced in accordance with the essential cybersecurity requirements set out in Annex I."
A SaaS company releases a new version of their product. Before release they must: update the SBOM with new components, verify there are no critical CVEs in added dependencies, and document changes in Annex VII.
EMETHRA automatically generates the SBOM on every commit, detects new CVEs in real-time and keeps Annex VII documentation updated without manual intervention.
CRA Compliance Process
The 5 steps to prepare your product
Software inventory
Identify all components of your product
Vulnerability analysis
Scan CVEs in all dependencies
Generate SBOM
Complete SPDX or CycloneDX
Document Annex VII
Complete technical documentation
Keep updated
Monitor CVEs and update
Reports generated by EMETHRA
Documentation ready for CRA compliance
Non-compliance sanctions
The consequences of not complying with the CRA
Sanciones aplicables
Additionally, authorities can order the product to be withdrawn from the European market.
Sectors affected by CRA
Who does the Cyber Resilience Act apply to?
Frequently asked questions about CRA
Answering the most common questions
The CRA applies to all products with digital elements marketed in the EU: standalone software, firmware, IoT devices, hardware with connected components, mobile applications and SaaS products with on-premise components. Only products already regulated by specific regulations such as medical devices or vehicles are excluded.
Need to comply with the CRA?
EMETHRA automates CRA Annex VII documentation generation, SBOM and alerts you to vulnerabilities for the 24-hour reporting requirement.
Request Product SnapshotRelated articles in the Observatory