What is the Cyber Resilience Act?

Dutch term: Cyber Resilience Act (CRA) | Legal basis: Regulation (EU) 2024/2847

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is an EU regulation imposing cybersecurity requirements on products with digital elements, including hardware and software, placed on the EU market. It applies to manufacturers, importers and distributors and follows the CE marking approach of the New Legislative Framework.

Products must meet essential cybersecurity requirements covering vulnerability handling, security updates, secure default configurations, and protection of data. Manufacturers must carry out a conformity assessment, draw up technical documentation, and provide security updates for the expected product lifetime (minimum five years). The CRA applies from late 2027 for most products, with earlier deadlines for reporting obligations.

Why it matters for international businesses

For IoT manufacturers, software companies and industrial equipment producers, the CRA adds a cybersecurity layer to the existing product compliance framework that must be integrated with CE marking, GPSR and sector-specific requirements.