EU Cyber Resilience Act Compliance

Executive Summary

Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), is the EU's first horizontal cybersecurity law for products with digital elements. It applies to virtually every connected product placed on the EU market — from consumer IoT devices and smart home appliances to industrial control systems, operating systems, firmware and standalone software. The CRA imposes mandatory security-by-design requirements, lifecycle vulnerability management obligations, technical documentation duties, conformity assessment procedures and CE marking requirements.

The CRA entered into force on 10 December 2024 and is being enforced in phases. Vulnerability reporting obligations under Article 14 became applicable on 11 September 2026 — manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours. Full enforcement of all substantive obligations — including security-by-design, secure default settings, software bill of materials (SBOM), conformity assessment and CE marking — begins on 11 December 2027. Fines for non-compliance reach up to €15 million or 2.5% of global annual turnover.

A commercial services market is forming around these requirements. Cybersecurity consultancies, product security assessment firms, SBOM tooling providers, conformity assessment bodies and secure development lifecycle (SDL) consultancies are clustering around CRA compliance needs. The scope is enormous: every manufacturer, importer and distributor of connected products sold in the EU must comply, regardless of where they are established.

This Topic Hub tracks whether an independent CRA compliance services market is forming, who participates, what evidence supports the thesis, and what remains uncertain.

Why This Market Is Forming Now

• Regulation is enforceable and partially active. The CRA is not a voluntary framework. Article 14 vulnerability reporting obligations have been in force since 11 September 2026. Manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours, with full incident reports within 72 hours. Full enforcement follows on 11 December 2027.
• Scope is horizontal and enormous. The CRA applies to all products with digital elements that have direct or indirect network connectivity. This includes consumer IoT, smart home devices, industrial control systems, operating systems, firmware, mobile applications, connected medical devices, smart toys and enterprise software. Every manufacturer, importer and distributor is in scope, regardless of establishment location.
• Security-by-design is mandatory. Products must be secure by default — default passwords must be eliminated, non-essential ports disabled, and security features enabled by default. Manufacturers must implement security-by-design throughout the product lifecycle, from development through end-of-support. These are not guidelines but binding legal requirements.
• CE marking creates a market access gate. From December 2027, products with digital elements must carry CE marking demonstrating CRA compliance before being placed on the EU market. This creates a binary market access requirement similar to what exists for product safety, electromagnetic compatibility and radio equipment — but now extended to cybersecurity.
• Supply chain obligations extend liability. Manufacturers must maintain software bills of materials (SBOM), conduct due diligence on third-party components, and bear joint liability for integrated components. This creates demand for supply chain security mapping, component auditing and SBOM management tooling.

Regulatory Timeline

Who Is Affected

What CRA Compliance Requires

CRA compliance is not a single certification. It is a set of security, documentation and assessment obligations spanning the entire product lifecycle.

Emerging Service Ecosystem

Evidence Classification

What Could Break the Thesis

• Further delays. The CRA already has a phased implementation. Political pressure from industry could trigger additional deadline extensions, reducing urgency for compliance investment.
• Self-assessment dominance. If most products fall into Class I (default) and can use self-assessment, the third-party conformity assessment market will be significantly smaller than expected.
• Enforcement inconsistency. Member states must designate competent authorities and notified bodies. If capacity varies widely, the level playing field may not materialise and enforcement may be uneven.
• Open-source exemption scope. If open-source software developed outside commercial activity receives broad exemptions, a significant portion of software development may operate outside the compliance framework.
• Tooling commoditisation. If automated SBOM generation and vulnerability scanning tools become sufficient for basic compliance documentation, the premium consulting and assessment market may be smaller than expected.

What Companies Should Prepare

1. Classify your products — determine which fall under CRA scope (any product with direct or indirect network connectivity) and identify the applicable class (default, important or critical)
2. Establish vulnerability reporting capability — build or procure a process for reporting actively exploited vulnerabilities to ENISA within 24 hours, with full analysis within 72 hours (this obligation is already active)
3. Conduct security-by-design review — audit your product development process against CRA Annex I requirements including secure default settings, authentication, access control, data encryption and secure update mechanisms
4. Generate SBOM — create a comprehensive software bill of materials for each product covering all third-party components, their versions and known vulnerabilities
5. Prepare technical documentation — compile security design specifications, risk assessment reports, vulnerability handling records and test evidence required for conformity assessment
6. Determine conformity assessment route — Class I products may use self-assessment; Class II and III require notified body assessment. Verify whether your product category has been classified
7. Map to IEC 62443-4-1 — align your secure development lifecycle with this widely referenced standard as evidence of CRA compliance
8. Plan for CE marking — integrate CRA conformity assessment into your existing CE marking process, ensuring technical documentation and EU declaration of conformity are ready before December 2027