Den Cyber Resilience Act verstehen
Eine Einführung in einfacher Sprache zur Verordnung (EU) 2024/2847 — was sie ist, wen sie betrifft und welche Pflichten sie schafft.
What is the CRA?
The Cyber Resilience Act (Regulation (EU) 2024/2847) is a horizontal EU regulation that introduces mandatory cybersecurity requirements for products with digital elements (PDEs) placed on the EU market. It entered into force on 11 December 2024.
The CRA applies throughout the product lifecycle — from design and development through to end of support. It establishes essential security requirements (Annex I), documentation obligations, a vulnerability reporting regime, and conformity assessment procedures. The goal is to ensure that hardware and software products are secure by design and remain secure throughout their supported life.
Who does it apply to?
The CRA applies to any economic operator that:
- Manufactures products with digital elements and places them on the EU market — including hardware with embedded software and standalone software products
- Imports products from non-EU manufacturers and places them on the EU market under their own name or trademark
- Distributes products on the EU market without altering them
- Open-source stewards who systematically provide free/open-source software intended for commercial use
Non-EU manufacturers who sell products into the EU are fully in scope. They must appoint an authorised representative established in the EU (Article 17).
What is a product with digital elements?
A product with digital elements (PDE) is any software or hardware product and its remote data processing solution, that has a direct or indirect data connection to a device or network. This intentionally broad definition covers:
- Consumer IoT devices (smart home, wearables, routers)
- Industrial hardware with network connectivity
- Standalone software applications (desktop, mobile, server)
- Operating systems and hypervisors
- Software components and libraries placed on the market
- Cloud-connected devices where the manufacturer controls the backend
Certain sectors are partially or fully excluded, including medical devices under MDR/IVDR, motor vehicles under type-approval regulation, civil aviation, and marine equipment.
Key deadlines
11 December 2024 — CRA enters into force
The regulation is legally in effect. Products placed on the market from this date must comply with CRA once the application dates are reached.
11 September 2026 — Vulnerability reporting obligations apply
Article 14 vulnerability and incident reporting to ENISA becomes mandatory. This is the first hard deadline. Manufacturers must have their reporting processes in place before this date.
11 June 2027 — Conformity assessment body notification
Member States must notify conformity assessment bodies to the Commission.
11 December 2027 — Full regulation applies
All CRA requirements apply to all in-scope products. No new products may be placed on the EU market that do not conform.
Bereit, tiefer einzutauchen?
Erkunden Sie die vollständige Pflichtenbibliothek, verstehen Sie Ihre Rolle oder sehen Sie den regulatorischen Zeitplan.