Cyber Resilience Act
From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents. The e-book explains who the CRA applies to, how to determine which category your product falls into and what obligations follow from that.
From product to obligations
For companies, the key questions are whether their products fall under the CRA, which category they belong to and what obligations follow from that. Manufacturers, importers and distributors each have different obligations. The e-book explains the parts of the regulation that will give you a realistic picture of how the CRA affects your products and help you plan your next steps.
What you'll find in the e-book
Which products the CRA applies to
What the CRA considers a product with digital elements, which products the regulation covers and where exemptions apply.
Obligations from 11 September 2026
Notification of actively exploited vulnerabilities and reporting of severe incidents apply from 11 September 2026.
How conformity is demonstrated
Product categories determine whether you can carry out the conformity assessment yourself or will need to involve a third party.
What manufacturers must address
Requirements for product security, documentation, vulnerability handling, security updates and other obligations throughout the product lifecycle.
7 chapters to help you navigate the CRA
The e-book will help you get a sense of what you will need to address, how demanding the next steps may be and where to start. After reading it, you will have a better basis for your first decisions:
- whether your product may fall under the CRA,
- which category you need to classify it in,
- how demanding the conformity assessment may be,
- what obligations await manufacturers, importers and distributors,
- what will need to be addressed in terms of vulnerabilities, updates and documentation.
If you’d rather not tackle this alone, get in touch. We will assess the impact of the CRA on your products, determine their category and prepare you to meet your obligations. How we can help with the CRA →
Who is this e-book for?
- Hardware and software manufacturers, whether based in the EU or in Asia and elsewhere outside the EU. Find out whether your products fall under the CRA and what you will need to change in development and related processes to keep placing them on the EU market.
- Importers and distributors of products with digital elements, including those who supply them under their own brand.
- Product and development teams, particularly those responsible for development, product management, compliance or certification.
Download your CRA e-book
Everything you need to know about the EU Cyber Resilience Act. The e-book covers who the CRA applies to, how to determine which category your product falls into and what obligations follow from that.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.