What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the EU’s horizontal regulation on cybersecurity requirements for “products with digital elements”: covering hardware, software and IoT products placed on the EU market, together with remote data processing solutions that are integral to the product’s functions. The CRA aims to address the patchy security landscape of consumer and B2B digital products by setting essential cybersecurity requirements throughout the product lifecycle. Entered into force on 10 December 2024; vulnerability and incident reporting obligations have applied since 11 September 2026, and the main obligations apply from 11 December 2027.
Scope: products with digital elements
- Hardware: connected devices, sensors, routers, smart appliances.
- Software: consumer applications, B2B software, embedded systems.
- Important and critical products (Annexes III and IV): identity management, browsers, password managers, antivirus, VPN, smart-meter components: face stricter conformity assessment.
- Excluded: medical devices, motor vehicles, civil aviation (covered by sector-specific regulation).
Core requirements
- Security by design and by default: minimised attack surface from initial release.
- Vulnerability management: coordinated disclosure, security updates throughout support period.
- Documentation: technical documentation evidencing compliance.
- Conformity assessment: CE marking after self-assessment or third-party assessment (for Class II important and critical products, and for Class I products where harmonised standards are not applied).
- Incident reporting: actively exploited vulnerabilities and severe incidents notified through the single reporting platform to the coordinating CSIRT and ENISA: early warning within 24 hours, notification within 72 hours, and a final report within 14 days after a corrective measure is available (vulnerabilities) or one month (incidents).
- Support period: manufacturer must provide security updates for the expected product use period (at least five years, unless the product is expected to be used for less).
CRA compliance planning
The Cyber Resilience Act turns product security into market-access law for anything with “digital elements” sold in the EU: security-by-design obligations, vulnerability handling and reporting duties (actively exploited vulnerabilities reported to the coordinating CSIRT and ENISA on tight clocks), CE marking against essential requirements, and support-period commitments. For Turkish hardware and software exporters the practical sequence is: classify products against the CRA’s importance categories, stand up a vulnerability-disclosure and PSIRT process now (the operational long pole), align technical files and conformity routes, and push the obligations into the supply chain: component and SDK vendors must contractually carry their share of the security file. CRA-readiness is becoming an RFP question well before its full application dates.