European Union. Cybersecurity. Regulation (EU)
CRARegulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
Partially in force
§1Summary
- Synopsis
Sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. Requirements include secure-by-design, vulnerability handling, security updates over a support period, an SBOM and CE marking. Manufacturers must report actively exploited vulnerabilities and severe incidents.
- Key themes
- Unique features
It extends CE-marking to software. Pure SaaS is generally excluded unless it is a 'remote data processing solution' that a product needs to function.
- SaaS relevance
Applies where SaaS is the remote data processing back-end for a product with digital elements, or where the provider also ships downloadable or on-prem software or apps.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ENISA/CSIRT: early warning 24h; notification 72h; final report 14 days (vulns) / 1 month (incidents)
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- €15m or 2.5% worldwide turnover
§3Dates
- Key dates
- Adopted
- In force
- Conformity assessment body provisions 2026-06-11; manufacturer reporting of actively exploited vulnerabilities and severe incidents 2026-09-11; full application 2027-12-11
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- National market surveillance authorities; ENISA (single reporting platform); CSIRTs
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.