In our recent blog, we covered NIS2, and what organisations need to know about the EU’s cybersecurity requirements. But NIS2 isn’t the only EU cybersecurity regulation businesses need to be aware of.

The Cyber Resilience Act (CRA) introduces cybersecurity requirements for products with digital elements sold on the EU market. This includes software, apps, operating systems, IoT devices, network equipment and connected hardware.

The CRA covers cybersecurity throughout a product’s lifecycle, including security by design and by default, vulnerability management, security updates, testing and reporting. It can also apply to businesses outside the EU if their products are placed on the EU market.

The main requirements apply from 11 December 2027, but some obligations are already in effect. Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and severe incidents affecting their products.

So, what does the CRA mean for your business, and what should you be doing now?

1. Does the CRA apply to your business?

Start by understanding whether your products fall within the scope of the CRA.

Ask yourself:

• Do we develop or manufacture software or connected hardware?
• Do our products connect directly or indirectly to a device or network?
• Do we sell these products in the EU?
• Are we importing or distributing products made elsewhere?

Not every digital product is covered, and some fall under other EU legislation. The CRA also contains specific provisions for free and open-source software.

It’s also important to understand your role, as responsibilities differ between manufacturers, importers and distributors.

2. Is cybersecurity built into your product?

A key principle of the CRA is security by design and by default.

Cybersecurity needs to be considered throughout development rather than added at the end. This includes secure configurations, authentication, access controls, data protection, appropriate cryptography and secure updates.

Manufacturers must also carry out a cybersecurity risk assessment and address the risks identified.

3. Do you know what is inside your product?

Modern software often relies on third-party libraries, open-source software and other components.

The CRA requires manufacturers to identify and manage these components and maintain a Software Bill of Materials (SBOM) covering, at a minimum, the product’s top-level dependencies.

You should know which components and versions are used in your products and how you monitor them for vulnerabilities. If a vulnerability is discovered in a component, you should be able to identify which products are affected.

4. Can you manage vulnerabilities throughout the product lifecycle?

Security doesn’t stop when a product reaches the customer.

Manufacturers need processes for identifying, addressing and remediating vulnerabilities throughout the product’s support period, including security updates and regular security testing and reviews.

You also need to consider how long the product will be supported and how security updates will be provided.

The question isn’t just whether your product was secure when it launched. It’s how you will keep it secure throughout its lifecycle.

5. Are you ready for the reporting requirements?

This is particularly important now.

Since 11 September 2026, manufacturers must report:

• Actively exploited vulnerabilities
• Severe incidents affecting the security of their products

For an actively exploited vulnerability, an early warning must be submitted within 24 hours of becoming aware of it, followed by a fuller notification within 72 hours.

Reports are submitted through the CRA Single Reporting Platform, operated by ENISA.

Make sure you know who is responsible for assessing incidents, deciding when a report is required and submitting it within the required timeframe.

6. Can you demonstrate that you meet the requirements?

The CRA isn’t simply about saying that your product is secure.

Manufacturers need appropriate technical documentation, a cybersecurity risk assessment, the required conformity assessment, an EU Declaration of Conformity and, where applicable, the CE marking.

The assessment route depends on the product. Some products can use self-assessment, while certain important and critical products have additional third-party assessment requirements.

Importers and distributors also have responsibilities to check that relevant requirements have been met. If they significantly modify a product or place it on the market under their own name or trademark, they may take on manufacturer responsibilities.

When does the CRA apply?

The CRA is being introduced in stages:

• 10 December 2024 – The CRA entered into force
• 11 June 2026 – Provisions relating to conformity assessment bodies began to apply
• 11 September 2026 – Vulnerability and incident reporting obligations began to apply
• 11 December 2027 – The main CRA requirements become applicable

So, while the main requirements are still ahead, some CRA obligations are already in force.

What should your business do now?

Don’t wait until 2027. Start by:

• Identifying which products fall within the CRA
• Understanding your role and responsibilities
• Reviewing how security is built into development
• Assessing vulnerabilities and third-party components
• Reviewing your SBOM and vulnerability management processes
• Preparing your reporting and incident response processes
• Checking your technical documentation and risk assessments
• Reviewing your support and security update processes
• Understanding your conformity assessment requirements

The CRA is more than a compliance exercise. It is pushing businesses towards making cybersecurity part of the entire product lifecycle.

With reporting requirements already in effect, it’s worth understanding where you stand now rather than waiting until 2027.

How can Forus-P help?

Preparing for the Cyber Resilience Act (CRA) means understanding the security risks in your digital products and knowing where improvements are needed.

At Forus-P, we provide web application vulnerability scans and penetration testing to help businesses identify security weaknesses in their applications, understand their potential impact and prioritise remediation.

Our scans combine automated testing with expert review, while penetration testing goes further by simulating real-world attack techniques to uncover vulnerabilities that automated tools may miss.

If you’re developing or managing software products, these services can help you assess your application’s security as part of your wider preparations for the CRA. The right approach will depend on your product, its risks and your specific requirements.

Developing a digital product and want to understand its security risks? Get in touch with Forus-P. We’re happy to help.

• Find out more about our vulnerability scanning services.
• Find out more about our penetration testing services.

This article provides general information and is not legal advice. CRA obligations vary depending on the product and the role of the organisation. Security testing can support your preparations but does not, on its own, establish CRA compliance. Refer to the official EU regulation and guidance when assessing your specific requirements.