Every product with digital elements sold in the EU — hardware and software, consumer and industrial — must be secure by design, supported through its lifetime, and its exploited vulnerabilities reported. The first obligations bite in September 2026. There is no small-company exemption.
At a glance
Scope
Hardware and software placed on the EU market; narrow exclusions (vehicles, medical, aviation — covered elsewhere)
Core duties
Secure by design/default, vulnerability handling, updates, support period, SBOM
Product classes
Defined precisely by Implementing Reg. (EU) 2025/2392 — 26 categories
Conformity routes
Class I self-assesses only with harmonised standards; Class II needs a notified body
Reporting
Actively exploited vulnerabilities and severe incidents, from 11 Sep 2026
Penalties
Of global turnover — plus market withdrawal, the real sanction
What it is
The CRA does to product security what the CE-marking directives did to product safety: it makes conformity a condition of market access. Manufacturers must meet Annex I’s essential requirements — secure development, no known exploitable vulnerabilities at release, secure defaults, security updates for the expected lifetime — and evidence it in technical documentation before affixing the CE mark. Importers and distributors inherit verification duties; open-source has carve-outs with edges worth checking.
Risk graduates the machinery. Default-category products self-assess. Important products — smart locks, cameras, baby monitors, connected toys, firewalls, password managers and more, pinned down by Implementing Regulation 2025/2392 — face constrained routes: Class I self-assesses only when applying harmonised standards, Class II requires a notified body regardless. Critical products (secure elements, HSMs, smart meter gateways) can be pushed by delegated act into mandatory European certification under EUCC.
Two clocks matter more than the headline date. Reporting obligations start 11 September 2026 — before any product requirement — turning PSIRT maturity into a legal obligation. And the harmonised standards the whole self-assessment economy depends on arrive late: product-specific standards from October 2026, horizontal ones through 2027, uncomfortably close to full application on 11 December 2027. Waiting for the standards is the most popular strategy and the worst one.
Key dates
Notifying authorities operate; CAB notification underway
Exploited vulnerabilities & severe incidents → ENISA + national CSIRT
Product-specific harmonised standards expected; horizontals follow in 2027
No conformity, no CE mark, no EU market
What it means for you
Which products, which class, which module — a defensible classification memo against Implementing Reg. 2025/2392 is the cheapest document you will ever commission. Everything else sequences from it.
The reporting obligation arrives first and tests operations, not paperwork: 24-hour early warning requires detection, triage and a decision chain that already works.
The evidence base exists today — EN 18031, EN 303 645, IEC 62443, SESIP. Build Annex I conformity on it now; reconcile with harmonised texts when they land. The delta will be small; the head start won’t be.
Class II demand meets a young NB market in 2027. Vendors with complete files in early 2027 get slots; the rest get a queue.
Where it lands
IoT & Embedded →
Consumer and industrial connected devices — RED overlap, evidence reuse, and the smart-home categories in Class I/II.
Semi-conductors →
Tamper-resistant MCUs/MPUs face notified bodies; secure elements face possible mandatory EUCC certification.
IACS / Industrial →
PLCs, SCADA and industrial network gear — and the EN IEC 62443 alignment that will carry presumption of conformity.
Labs, CBs & Schemes →
Notification strategy, competence files and the capacity race before December 2027 — the operators’ side of the CRA.
The standards that answer it
Expert notes
The CRA obliges support “for the expected product lifetime” (minimum five years in most cases) and makes the declared period a market-surveillance surface. That number is a supply-chain commitment — chipset firmware, third-party stacks, cloud dependencies — and it is compared across regimes: PSTI publishes it, buyers negotiate on it, regulators cross-read it.
Our position: derive the period from a documented component-support analysis before marketing touches it. One defensible number, used everywhere.
The Article 14 flow — 24-hour early warning, 72-hour notification, final report — via ENISA’s single reporting platform coexists with NIS2 reporting, GDPR breach notification and sector regimes. Products in the field for fifteen years, telemetry you may not have, and “actively exploited” determinations under time pressure: this is an operational capability with legal deadlines attached.
Our position: one intake, one severity model, one decision log, mapped outward to every regime’s clock. Design it once in 2026, or improvise it per incident forever.
Classification, PSIRT readiness, evidence architecture, notified-body strategy — thirty minutes with people who work this regulation daily.
We’ll send you access by email.
