The EU Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for software and hardware products made available on the EU market.
For international manufacturers, the change is significant: cybersecurity becomes a regulatory requirement applying directly to the product throughout its lifecycle.
Most CRA requirements will apply from 11 December 2027.
But one important deadline has already passed: since 11 September 2026, manufacturers have been subject to the CRA reporting obligations for actively exploited vulnerabilities and severe security incidents.
The CRA is therefore no longer only a 2027 compliance project.
The CRA applies to “products with digital elements” made available on the EU market.
This includes hardware and software products whose intended or reasonably foreseeable use involves a direct or indirect connection to a device or network. Certain remote data processing solutions that are necessary for the product to perform one of its functions may also be included.
For software companies, this matters: the CRA is not limited to IoT devices or physical connected products.
Standalone software can also fall within its scope.
Some products are excluded or subject to specific sectoral regimes, so the first step is to determine whether the product is covered and what role the company performs in placing it on the EU market.
Manufacturers must perform a cybersecurity risk assessment and take that assessment into account when planning, designing, developing, producing, delivering and maintaining the product.
The CRA therefore affects much more than the final security testing performed before release.
Manufacturers will need processes addressing areas such as secure design, vulnerability management, security updates and the security of components integrated into the product.
Third-party and open-source components also need to be considered as part of this process.
For companies selling products globally, this may require reviewing whether their existing development and product-security processes provide the information and controls needed for CRA compliance.
Manufacturers remain responsible for handling vulnerabilities during the product’s support period.
This includes identifying and documenting vulnerabilities and components, testing and reviewing product security, addressing vulnerabilities without delay and distributing security updates securely.
The CRA also requires manufacturers to establish a coordinated vulnerability disclosure policy and provide a contact address through which vulnerabilities can be reported.
This has practical consequences.
The company needs to know who receives a vulnerability report, how it is assessed, who decides whether action is required and how security updates are delivered to users.
Those processes can no longer be treated only as internal security practices: they form part of the product’s regulatory compliance.
Since 11 September 2026, Article 14 reporting requirements apply to products with digital elements made available on the EU market — including products placed on the market before the CRA becomes fully applicable in December 2027.
Manufacturers that become aware of an actively exploited vulnerability affecting their product are subject to a staged reporting process, beginning with an early warning within 24 hours.
Reporting obligations also apply to severe incidents having an impact on the security of the product.
For international manufacturers, this means that the reporting process needs to work across the organization now, not in December 2027.
Security teams need to be able to identify a potentially reportable event and ensure that the information reaches the people responsible for assessing and making the regulatory notification within the required timeframe.
The CRA requires manufacturers to determine a support period for the product.
During that period, they remain responsible for vulnerability handling and security updates.
The appropriate period depends on factors including the type of product, its expected use and users’ reasonable expectations.
This has consequences beyond regulatory documentation.
Product lifecycle, maintenance commitments and commercial support arrangements need to be consistent with the CRA support period.
A company should therefore consider this issue when designing its support model, rather than waiting until the product reaches the end of its commercial life.
CRA compliance also needs to be documented.
Manufacturers must prepare the required technical documentation and complete the applicable conformity assessment process before placing the product on the EU market.
Once conformity has been demonstrated, the product is accompanied by an EU declaration of conformity and bears the CE marking.
The procedure will depend in part on the product concerned. The CRA distinguishes between ordinary products with digital elements and certain important or critical products, for which different conformity assessment requirements may apply.
International manufacturers should therefore determine the product’s classification early enough to understand what conformity process will be required before the 2027 deadline.
CRA compliance may depend on information or action from other companies involved in the product.
A manufacturer may rely on software components, cloud or technical services, external developers or other suppliers.
Its contracts with those parties may therefore need to support its own CRA processes.
Depending on the relationship, this may include access to information about components, vulnerability notifications, security updates, cooperation following an incident or commitments concerning vulnerability handling.
The point is not to pass the entire CRA down the supply chain.
It is to identify what the manufacturer needs from each relevant supplier in order to meet its own obligations.
International software and connected-product manufacturers selling into the EU should now be working on two timelines.
The immediate issue is Article 14: reporting obligations have applied since 11 September 2026.
The broader compliance project leads to 11 December 2027: product classification, cybersecurity risk assessment, vulnerability handling, support periods, technical documentation and conformity assessment all need to be ready for the CRA’s general application.
For manufacturers already operating mature product-security processes, the CRA does not necessarily mean starting again from scratch.
The task is to identify where existing processes already meet CRA requirements — and where they need to be adapted for the EU regulatory framework.
Withlaw assists international software and technology companies preparing for the Cyber Resilience Act, including:
Our objective is to help international manufacturers integrate CRA requirements into their existing product, security and contractual frameworks without creating unnecessary parallel processes.