EU Cyber Resilience Act
Do you make connected devices, electronics or software and sell them in Europe? From 11 December 2027, these products can only enter the EU market if they meet the Cyber Resilience Act (CRA) and carry the CE marking. We help manufacturers from Asia and other regions prepare their products and documentation so they can keep selling in Europe.
Why the CRA matters for exporters
Europe is a key export market and the Cyber Resilience Act (Regulation (EU) 2024/2847) changes the conditions of access to it. The CRA sets cybersecurity requirements for hardware and software products sold in the EU. The requirements go beyond technical security. They cover the whole product lifecycle: risk assessment, secure design, vulnerability handling, security updates, technical documentation, conformity assessment and CE marking.
What counts is where the product is sold, not where it was made. The CRA applies to manufacturers, importers and distributors of products with digital elements, including companies with no office in the EU.
How we can help
First, we find out where you stand in relation to the CRA. Then we take you through the preparation step by step. For in-depth technical work, such as security testing, we work with trusted long-term partners. We can deliver the whole preparation or recommend partners and coordinate them for you. If you already have ISO 27001 or CE-mark your products under other EU legislation, we build on that.
Impact assessment and gap analysis
- Find out which of your products fall under the CRA and what your role is for each one.
- Get your products classified (default, important class I or II, critical). The class decides which conformity assessment route you take.
- See how your current development, documentation and support processes compare with the CRA, what's missing and what to tackle first.
You get: a gap analysis with a clear, prioritised plan.
Preparing for conformity
- A cybersecurity risk assessment, which the rest of your CRA obligations build on.
- Technical documentation, including the SBOM and a coordinated vulnerability disclosure (CVD) policy.
- Hands-on support through the conformity assessment. If you can self-assess, your EU declaration of conformity will be ready to sign. If you need a notified body, we prepare the materials and manage the process.
You get: a complete documentation package, ready for assessment and for your European customers.
Ongoing compliance
- A clear process for reporting vulnerabilities and incidents to EU authorities.
- A CRA information pack to share with your EU importers, distributors and brand customers.
- Training for your management, engineering and product teams on what the CRA means for them.
You get: processes and materials that keep you compliant and make working with EU partners easier.
Organisations that trust us with their cybersecurity
What non-EU manufacturers need to prepare
Your EU importer will check you
An importer may only sell your product if the conformity assessment, technical documentation and CE marking are in order. Incomplete documentation means delayed or lost orders.
Reporting obligations already apply
Since 11 September 2026, you must report actively exploited vulnerabilities and severe incidents through the EU single reporting platform. The first warning is due within 24 hours. You need a process and people who can respond fast.
Support over the product's lifetime
The support period is generally at least five years. You must keep the technical documentation for ten years, or longer if the support period is longer. Plan these costs into your pricing and after-sales support.
Documentation for European users
User information and instructions must be in a language that users in each EU country can understand. The EU declaration of conformity must be translated where required.
You can appoint an authorised representative
A company established in the EU can act on your behalf for certain tasks, based on a written mandate. It can, for example, keep your documentation available for authorities. Responsibility for the product design and conformity assessment stays with you.
A short consultation is enough to
define the next step
Initial consultation
Tell us about your products and how they reach the European market. You don’t need to know yet whether the CRA applies to you or what your role is. Working that out is part of the first call.
Scope & proposal
You’ll receive a clear proposal: which products are in scope, what needs to be done, the estimated timeline and the price. You decide whether to continue only once you have the full picture.
Preparation
Our consultants work with your R&D, product and quality teams to prepare the risk assessment and processes the CRA requires. Everything is handled online, and your documentation is ready to share with your EU importers and customers.
Ongoing support
CRA compliance doesn’t end with the CE marking. After launch, you can count on help with vulnerability and incident reporting, updates to your documentation for new product versions, requests from EU customers or authorities.
Your cybersecurity partner on the EU side
We are a cybersecurity and digital compliance consultancy based in Prague, Czech Republic. Our consultants have a legal or IT background and understand how EU regulation works day to day. We work in English and can run the whole project remotely.
Find your way around the CRA with CRA Point
CRA Point is our information platform for manufacturers, importers and distributors, with practical tools that help you:
- run a basic self-assessment of your product,
- follow up with a more detailed gap analysis,
- work through your obligations using practical checklists,
- understand the CRA requirements and plan your next steps.
The CRA Point project is supported through financial support to third parties (FSTP) under the Building Testing and Certification Capabilities in the Czech Republic (TEST-CERT-CZ) project, funded by the Digital Europe Programme.
FAQ
Does the CRA apply to products made outside the EU?
Yes. What matters is whether the product is sold on the EU market, not where it was developed or made.
What is a product with digital elements?
Any hardware or software product that can connect to a network or another device. Typical examples are smart home devices, industrial IoT, routers, cameras, wearables, apps and machinery with embedded software. Some categories are excluded because they have their own sector rules, such as medical devices, motor vehicles and certified aviation systems.
Do we need third-party certification?
It depends on the product’s classification. Most products can be self-assessed by the manufacturer. For important class I products, self-assessment is only possible if harmonised standards or European certification are applied in full. Class II and critical products require a notified body or European certification.
We already CE-mark our products. What changes?
If you CE-mark under RED, EMC or LVD, you know the process. The CRA adds cybersecurity requirements, and there is still only one CE marking. Your existing cybersecurity work, for example under RED, can be a good starting point.
Can we work with you entirely remotely?
Yes. We work in English and online, and we schedule meetings to suit Asian time zones.
Let’s discuss what your business needs
Tell us about your products and how you sell them in Europe. We’ll assess whether the CRA applies, what role you play and what you need to prepare, so you can keep supplying the EU market without interruption. Online and in English.