How ready are you for the Cyber Resilience Act?
The CRA introduces mandatory cybersecurity requirements for almost every hardware and software product sold in the European Union. The obligation to report actively exploited vulnerabilities and severe incidents has applied since 11 September 2026; all other obligations apply from 11 December 2027. For violations the regulation provides administrative fines of up to 15 million euros or 2.5% of worldwide annual turnover.
A self-assessment of where you stand today
Built for manufacturers of connected devices: R&D, product management, quality. Yes is worth 2 points, Partly 1, No 0. The result is computed in your browser.
Have you mapped which of your products fall under the definition of “product with digital elements”, i.e. hardware or software with a direct or indirect data connection to a device or network?
Have you checked, product by product, whether you fall in the default category, among “important” Class I or II products, or among “critical” ones? The class determines the assessment route: self-assessment, harmonised standards or a notified body.
Is there an internal owner for CRA compliance, with a plan and deadlines to be ready by December 2027?
Do your products ship with a secure-by-default configuration: no credentials shared across units, unnecessary services disabled, attack surface reduced to a minimum?
Are products released without known exploitable vulnerabilities, based on documented security testing and a cyber risk assessment that is part of the product documentation?
Is there a secure update mechanism, verifying firmware integrity and authenticity through digital signatures? And, where applicable, are automatic security updates enabled by default, with a simple way for the user to opt out?
Is the data handled by the product protected in transit and at rest where relevant, with data minimisation, security event logging and basic resilience against denial-of-service attacks?
Do you have an SBOM, the bill of materials of your software components, for each product, in a machine-readable format, covering at least top-level dependencies and updated at every release?
Do you have a published coordinated vulnerability disclosure (CVD) policy, with a contact channel to receive reports from outside?
Are vulnerabilities fixed without undue delay, with free security updates distributed securely and public advisories for the ones resolved?
If you discovered an actively exploited vulnerability in one of your products tomorrow, could you meet the reporting windows to the competent authorities (your national CSIRT and ENISA): early warning within 24 hours, notification within 72, final report to follow? This obligation has applied since 11 September 2026.
Do you perform due diligence on the third-party components you integrate, including open source: tracked in the SBOM and monitored for new vulnerabilities?
Does your technical documentation cover what is required: risk assessment, design and development description, vulnerability handling process, ready to support the EU declaration of conformity and CE marking?
Have you defined the support period for each product, as a rule at least five years, during which you guarantee security updates, with the end date communicated to the user?
Does the user information include the contact for reporting vulnerabilities, where to find updates, the intended use and the essential security properties of the product?
If you substantially modify someone else's product or resell it under your own brand, are you aware that in the eyes of the CRA you become the manufacturer, with all the obligations that follow?
This tool is for information only and does not constitute legal advice or a conformity assessment under Regulation (EU) 2024/2847. The questions simplify requirements that in the text carry conditions, exceptions and special cases: the score points at areas of attention, not at a compliance status.
The four areas in this check come from the obligations in the regulation. If you want to understand them properly before deciding how to move, the course walks through them in about fifty minutes: six short modules, each with a downloadable tool you can use right away.
Go to the course on UdemyPurchase and access are handled by Udemy.
Want a reasoned read of your result on your product?
Write me: info@maber-solutions.it These areas are the ones covered by the embedded security course →Cyber Resilience Act: what business decision-makers need to know
The Cyber Resilience Act, or CRA, is the first European regulation that makes cybersecurity a mandatory condition for market access. In practice, a non-compliant product can no longer be sold in the European Union. If you run a company that makes or distributes connected devices, this is not just a technical matter to delegate: it is a question of business continuity, legal liability and reputation. This page sums up the essentials from a decision-making angle, and the check above gives you a first measure of your readiness in five minutes.
Who the CRA applies to
The practical rule is simple: if you sell something that contains software and that, directly or indirectly, connects to a device or a network, the CRA most likely applies to you. The regulation refers to "products with digital elements", a deliberately broad definition covering hardware, software and components sold separately. Only a few sectors already governed by their own rules are excluded, such as medical devices, automotive and aviation. For the vast majority of companies making electronic equipment, gateways, sensors or connected products, the question is not whether the CRA applies, but how much work compliance will take.
The CRA deadlines to put in your calendar
The regulation is already in force and the CRA deadlines are set. From 11 September 2026, the obligation to report actively exploited vulnerabilities and serious incidents to the authorities is in effect, with very tight windows: an early warning within 24 hours. From 11 December 2027, all other obligations apply, including the essential security requirements and the CE marking, which now includes cybersecurity. The 2027 date may seem far off, but for anyone thinking in product cycles it is not: classifying your catalogue, documenting the risk assessment, setting up vulnerability-management processes and updating technical documentation take months, not weeks.
The CRA requirements in short
The CRA requirements can be read on two levels. At the product level, the regulation calls for devices delivered with a secure default configuration, with no known exploitable vulnerabilities at release, with data protection, a reduced attack surface and security updates. At the process level, it requires the manufacturer to manage vulnerabilities across the whole lifecycle: a public contact point for reports, fixes distributed without undue delay, a software bill of materials and a declared support period, generally at least five years. A product that is secure at the point of sale is not enough: it takes an organisational commitment that lasts as long as the product stays on the market.
CRA implications for companies making connected devices
The CRA implications for a company go beyond the engineering department. For those making embedded systems and connected devices, compliance touches design, documentation, supplier contracts and after-sales service. The penalties are designed to get noticed at board level: up to 15 million euro or 2.5% of annual worldwide turnover for breaching the essential requirements, plus the authorities' power to order products withdrawn from the market. But the risk is not only the fine: it is the liability that falls on the manufacturer even for the third-party software components it integrates, and the reputational damage with customers and partners the moment a non-compliant product is stopped.
Where to start
The first concrete step is to understand where you stand today, product by product: which ones fall in scope, in which risk class, and how far the current state is from the requirements. The check above is built exactly for this, as an initial snapshot rather than formal consultancy. From there, the path to compliance is manageable, but it needs to be planned ahead and with the right expertise on board, whether in-house or through specialised partners.
Need a view on your specific case?
If you need to work out how to approach the CRA, which products are involved and how to plan the compliance path, let's talk. An initial conversation helps turn the regulation into a concrete list of priorities.
Let's talk: info@maber-solutions.itThis page is for information and general guidance only and does not constitute legal advice. Regulatory references may evolve: for binding decisions, always refer to the official text of the regulation and to qualified advice.