How ready are your products for the EU Cyber Resilience Act?

The risk assessment must start from intended purpose, foreseeable use and conditions of use. prEN 40000-1-2 §6.2 lists the context elements.

A documented risk assessment is mandatory. It goes into the technical documentation and must inform planning, design, development, production, delivery and maintenance.

The 13 requirements cover known vulnerabilities, secure defaults, security updates, access control, confidentiality, integrity, data minimization, availability, impact on other networks, attack surface, exploit mitigation, logging, and secure data removal. Any requirement you rule out needs a written justification.

The assessment must stay current for the whole support period, including vulnerabilities and third-party information you become aware of.

Products must be designed, developed and produced to ensure security appropriate to the risks. The CRA doesn’t prescribe how; prEN 40000-1-2 §7 describes the expected lifecycle activities.

No known exploitable vulnerabilities when the product is placed on the market, plus effective and regular security tests and reviews.

A secure default configuration with a reset option, and a limited attack surface including external interfaces. The ENISA Secure by Design and Default Playbook gives practical guidance.

Automatic security updates by default where applicable, with opt-out and postponement; security fixes separate from feature updates where technically feasible; secure distribution.

Due diligence on all third-party components, including open source. If you find a vulnerability in a component, you must report it to the maintainer and share your fix.

An SBOM is mandatory. You don’t have to publish it, but market surveillance authorities can request it (Annex VII(8)).

Vulnerabilities must be remediated without delay for the whole support period, which requires knowing when a new CVE affects a shipped version.

A CVD policy and a single point of contact are mandatory, and fixed vulnerabilities must be disclosed publicly with severity and remediation guidance.

At least five years unless the product’s expected use is shorter. The end date must be clear at purchase, and each security update must remain available for 10 years or the rest of the support period, whichever is longer.

Applies since 11 September 2026, including to products already on the market. Reports go through ENISA’s single reporting platform. The final report is due 14 days after a fix is available (vulnerabilities) or one month after the notification (incidents).

The 24-hour clock starts when you become aware of the issue, weekends included. Art. 14(5) defines when an incident counts as severe.

Most products can use the internal control procedure (Module A). Class I products can only do so if they apply harmonised standards in full; class II and critical products need a notified body or certification.

Required before placing on the market, together with the EU declaration of conformity, and kept for at least 10 years.

Mandatory user information, kept available for at least 10 years.