The EU Cyber Resilience Act Is Now in Force. Is Your Product Ready?

If you sell software or connected hardware to customers in the European Union, Regulation (EU) 2024/2847 already applies to you. Reporting duties went live on September 11, 2026. Full enforcement arrives December 11, 2027.

Start Your Free Consultation What You Need to Know
Live now: 24-hour vulnerability reporting
Up to €15M or 2.5% of global turnover
Dec 11, 2027: CE marking required
Washington, D.C.  |  November 4, 2026

EU Cyber Resilience Act Reporting Duties Now in Effect for Software and Device Makers, with Full Enforcement Set for December 2027

The European Union's Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is now actively changing how software and connected hardware are built, sold, and supported. The CRA is the first law to set mandatory cybersecurity requirements for nearly every hardware and software product sold in the EU market.

The regulation moves responsibility for product security away from end users and onto the companies that make, import, and distribute digital products. It creates a legal "duty of care" that lasts for the entire life of a product, from design through end of support.

The first deadline has already passed. Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents to the EU's Single Reporting Platform, run by ENISA, with an early warning due within 24 hours. On December 11, 2027, every in-scope product must meet the CRA's essential security requirements, pass a conformity assessment, and carry the CE mark before it can be sold in the EU.

The CRA is not limited to European companies. Any business, including a small U.S. software company or device maker, that places a product with digital elements on the EU market is in scope.

"Security is always too much, until it wasn't enough. The CRA puts a price on 'wasn't enough.' Most of the companies we talk to don't need an army of consultants. They need someone to tell them plainly whether they're in scope, what's missing, and who's going to file the report when the 24-hour clock starts. That's what we do."

ASI's CRA services help organizations confirm scope and product classification, close gaps against the CRA's Annex I security requirements, build the technical file and Software Bill of Materials (SBOM) the law requires, and prepare and submit Article 14 reports on the client's behalf when an exploited vulnerability or severe incident occurs.

Key Dates

The clock is already running

The CRA rolls out in phases. One phase is behind us, and the biggest is just over a year away.

Done
Late 2024

Entry into force

Regulation (EU) 2024/2847 is published and the transition window opens.

In effect now
Sept 11, 2026

Article 14 reporting begins

ENISA's Single Reporting Platform opens. Exploited vulnerabilities and severe incidents must be reported on a strict timeline.

Scope

Does the CRA apply to you?

The law covers products with digital elements: any hardware or software whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network.

Manufacturers

Software publishers, SaaS-adjacent installable products, apps, firmware, IoT and connected devices. You carry the heaviest obligations, including design, documentation, updates, and reporting.

Importers & Distributors

If you bring products into the EU or resell them, you must verify CE marking and documentation, and stop distributing products you know are non-compliant.

Non-EU Companies

Being based in the U.S. does not exempt you. If your product is made available on the EU market, the CRA applies to that product.

Not in scope: products already governed by sector-specific rules, such as medical devices and motor vehicles. Spare parts supplied by the original manufacturer to replace existing components are also exempt.

By the Numbers

What the CRA asks of you

24 hrs
to send an early warning after learning of an actively exploited vulnerability
5 yrs
default security support period, with free security updates throughout
10 yrs
to retain technical documentation and the EU Declaration of Conformity
~90%
of products fall in the default class and can self-assess, if documented correctly
Core Requirements

Secure by default, supported for life

Annex I of the regulation sets out what every in-scope product must deliver.

Secure by default

  • Minimize exposed ports, interfaces, and features
  • No hardcoded default passwords
  • Strong confidentiality and integrity controls

Automatic updates

  • Security updates on by default, with opt-out
  • Security patches separated from feature updates where feasible
  • Updates free for the full support period

Software Bill of Materials

  • Track top-level and nested dependencies
  • Open-source and proprietary components
  • Kept current as the product changes

Technical file

  • Design specs and risk assessment
  • Test results and manufacturing records
  • Ready before the product goes to market
The Compliance Path

Eight steps from scope to CE mark

This is the journey every manufacturer has to complete before December 11, 2027, and maintain afterward.

Confirm scope & class

Is it a product with digital elements? Default, important, or critical?

Art. 2, 6, 7

Assess cyber risk

Document threats and decide which Annex I requirements apply.

Art. 13(2)

Meet essential requirements

Secure configuration, reduced attack surface, data protection.

Annex I, Part I

Run vulnerability handling

Maintain an SBOM, fix flaws, ship free security updates.

Annex I, Part II

Build the technical file

Specs, risk assessment, and test logs, before market placement.

Annex VII

Pick the assessment route

Self-assessment, harmonized standards, or third-party audit.

Art. 32

Declare & affix CE

Sign the EU Declaration of Conformity and mark the product.

Art. 28, 30

Monitor & report

Watch fielded products, report exploits, take corrective action.

Art. 13(8), 14
Product Classification

Your risk class decides how you prove compliance

Internal self-assessment

Most software and connected hardware. You complete a Module A internal control assessment, compile the technical file, and sign the EU Declaration of Conformity yourself. Easier, but only if your evidence holds up.

Standards or third-party audit

Higher-risk products listed in Annex III, such as SIEM and XDR systems. Compliance runs through harmonized European standards or an assessment by a Notified Body.

Mandatory external certification

Security-critical components and high-risk infrastructure. Requires external audits and may require a formal European cybersecurity certification scheme.

Article 14 · In Effect Now

When something goes wrong, the 24‑hour clock starts

Two kinds of events must be reported through ENISA's Single Reporting Platform: actively exploited vulnerabilities and severe incidents that affect a product's availability, authenticity, integrity, or confidentiality.

24
Hours

Early warning

Initial alert after you become aware of active exploitation or a severe incident.

72
Hours

Notification

General event details and an initial impact assessment.

14
Days after fix

Final report (vulnerability)

Due no later than 14 days after a patch or corrective measure is available.

1
Month

Final report (incident)

Due within one month of the 72-hour notification.

Reports go to your home country's designated CSIRT and are shared with other affected Member States and market surveillance authorities. A weekend discovery does not pause the clock.

Enforcement

What non-compliance costs

Article 64 sets three tiers of fines. Authorities apply whichever is higher: the fixed euro amount or the percentage of global annual turnover.

TierMaximum fineTypical violations
Highest
Art. 64(2)		€15 millionor 2.5% of global turnoverBreaching Annex I security requirements or manufacturer duties. Missing Article 14 reports. Shipping hardcoded default passwords, failing to maintain updates, omitting an SBOM.
Mid
Art. 64(3)		€10 millionor 2% of global turnoverImporter and distributor failures. Missing or incomplete EU Declaration of Conformity. Improper CE marking.
Lower
Art. 64(4)		€5 millionor 1% of global turnoverGiving incorrect, incomplete, or misleading information to Notified Bodies or authorities, including inaccurate technical files.

Fines are only the start

Market surveillance authorities can also:

Withdraw non-compliant products from the EU market

Prohibit you from placing new products on the market

Recall sold products from customers at your expense

Order specific code or architecture changes on tight deadlines

Example: a company with €100M annual revenue

Direct fine (2.5% of turnover)€2.5M
Product recall costs€1.0M to €5.0M
Legal & remediation fees€0.5M to €2.0M
Total potential impact€4.0M to €9.5M+

Smaller companies get some relief. Fines must be proportionate to company size, and micro and small enterprises are exempt from fines for missing the 24-hour and 72-hour reporting deadlines. The reporting duty itself still applies.

How ASI Helps

We tell you what you actually need, then we help you get there

ASI brings enterprise-grade credentials to small and mid-sized software and device makers, without the enterprise costs.

CRA Readiness Assessment

A plain-language answer to "are we in scope, and how far are we from compliant?"

  • Scope confirmation and risk-class determination
  • Gap analysis against Annex I security requirements
  • Prioritized, step-by-step remediation plan
  • Report written for leadership, not just engineers

Security Hardening & Testing

Close the gaps the assessment finds, then prove it.

  • Secure-by-default configuration review
  • Vulnerability assessment and remediation support
  • Penetration testing when you're ready for it
  • Comparative follow-ups that document progress

Documentation & SBOM

The evidence you need on file before December 2027.

  • Software Bill of Materials generation and upkeep
  • Vulnerability handling and disclosure policies
  • Technical file and risk assessment support
  • EU Declaration of Conformity preparation

Article 14 Reporting on Your Behalf

When the 24-hour clock starts, you shouldn't be learning the process for the first time.

  • Reporting playbook built before you need it
  • Early warning, notification, and final report preparation
  • Submission to ENISA's Single Reporting Platform
  • Coordination with your engineering team on the fix
FAQ

Common questions

We're a U.S. company. Does the CRA really apply to us?

Yes, if you make a product with digital elements available on the EU market. The CRA follows the product, not the company's headquarters. If you have EU customers, resellers, or app store listings, start with a scope check.

Our product is software only. Is it covered?

Very likely. The CRA covers both hardware and software whose intended use includes a data connection to a device or network. Products already covered by sector-specific rules, like medical devices and motor vehicles, are excluded.

Full enforcement is in December 2027. Why act now?

Two reasons. Article 14 reporting is already in effect, so an exploited vulnerability today triggers a 24-hour deadline. And building secure-by-default design, an SBOM, and a technical file takes time. Waiting until late 2027 leaves no room to fix what an assessment finds.

How does the CRA relate to NIS2?

They work together. NIS2 regulates how organizations that run essential and important services manage cyber risk. The CRA regulates the security of the products themselves. Some companies are subject to both.

What about open-source software?

Non-commercial open-source projects are treated differently. The CRA created a new role, the "open-source software steward," which must handle vulnerabilities and report under Article 14 but is exempt from fines. If you build a commercial product on open-source components, you are still responsible for those components in your product.

Does ASI replace a Notified Body?

No. Products in the Important and Critical classes may require a third-party assessment by an EU Notified Body. ASI prepares you for that review, so your evidence, documentation, and controls are in order before the auditor arrives. Most default-class products can self-assess with the right documentation.

Free, No-Commitment Consultation

Find out where you stand before the regulators do

In one conversation, we'll help you determine whether your products are in scope, which risk class applies, and what it will take to be ready for December 2027.

Start Your Free Consultation

Prefer email? Reach us at info@asiweb.org

About Assured State Innovations, LLC

Assured State Innovations (ASI) is a certified American-owned IT and cybersecurity firm headquartered in the Washington, D.C. metro area, serving clients locally and nationwide. ASI delivers security assessment and hardening, penetration testing, security awareness training, network infrastructure, managed IT, and secure web services to small and mid-sized businesses and non-profits. The ASI team holds industry-recognized certifications including CISSP, GIAC GPEN, GCCC, and more. ASI's reports are clear, concise, and written for decision-makers. Learn more at asiweb.org.

"State-of-the-art cyber consulting for your average Joe."

Media Contact

Assured State Innovations, LLC

info@asiweb.org

www.asiweb.org

###

This release summarizes Regulation (EU) 2024/2847 (Cyber Resilience Act) for general information only and is not legal advice. Penalty figures are statutory maximums; the cost example is illustrative. Organizations should confirm their specific obligations with qualified legal counsel. ASI is not an EU Notified Body.