UK What the Cyber Resilience Act is
The Cyber Resilience Act (CRA) is an EU regulation that makes cybersecurity a condition for selling connected products in the European Union. It was published as Regulation (EU) 2024/2847 in November 2024 and entered into force on 10 December 2024. As a regulation rather than a directive, it applies directly in every EU member state.
The CRA covers “products with digital elements”: hardware and software whose intended use includes a data connection to a device or network. That takes in industrial PCs, gateways, controllers, switches, HMIs, embedded firmware and standalone software, as well as consumer devices. Manufacturers must design products to meet essential cybersecurity requirements, handle vulnerabilities for a defined support period and show conformity with the CE marking, which already covers other EU product law.
This page summarises the regulation for people who buy and integrate industrial hardware. It is not legal advice. The text of the regulation and the European Commission’s guidance are the reference.
Who the CRA applies to
The CRA places duties on each economic operator in the supply chain, and on any business that changes a product enough to become its manufacturer.
-
//
Manufacturers. Anyone who designs or makes a product, or has it made, and sells it under their own name. They carry most of the obligations.
-
//
Importers and distributors. They must check that a product from outside the EU carries the CE marking and documentation, and act if they learn of a vulnerability.
-
//
Integrators and modifiers. A business that makes a substantial modification to a product, or sells a combined product under its own brand, can take on the manufacturer’s duties for it.
-
//
Open-source stewards. Organisations that support free and open-source software for commercial use have lighter, specific obligations.
-
//
Exclusions. Products already covered by sector rules, such as medical devices, motor vehicles, civil aviation and marine equipment, are outside its scope, as are products made only for defence or national security.
Essential requirements and vulnerability handling
Annex I of the regulation lists the essential requirements in two parts. Part I covers the product itself: it should ship without known exploitable vulnerabilities, with a secure default configuration, protection against unauthorised access, protection of the confidentiality and integrity of data and firmware, a limited attack surface, security logging and the ability to receive security updates.
Part II covers the manufacturer’s processes: a software bill of materials (SBOM) for the product’s components, a coordinated vulnerability disclosure policy, regular security testing and free security updates for the support period. That period should reflect how long the product is expected to be used and is generally at least five years. For industrial hardware it is often longer, so a supplier’s firmware and BIOS update record matters.
From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through the EU single reporting platform run by ENISA: an early warning within 24 hours, a fuller notification within 72 hours and a final report afterwards. Penalties for breaching the essential requirements can reach 2.5% of worldwide annual turnover.
CRA product categories
Most products fall into the default category, which the manufacturer can self-assess. Products with security functions, or whose compromise would have a wider impact, are listed as important or critical and face stricter conformity assessment.
| Category | Examples listed in the regulation | Conformity route |
|---|---|---|
| Default | Most connected hardware and software not listed in Annex III or IV | Self-assessment by the manufacturer |
| Important, Class I (Annex III) | Routers, modems and switches; operating systems; boot managers; network management systems; microprocessors and microcontrollers with security functions | Self-assessment only if harmonised standards or certification are fully applied, otherwise third-party assessment |
| Important, Class II (Annex III) | Firewalls, intrusion detection and prevention systems, hypervisors and container runtimes, tamper-resistant microprocessors and microcontrollers | Third-party assessment by a notified body, or EU certification |
| Critical (Annex IV) | Hardware devices with security boxes, smart meter gateways, smartcards and secure elements | European cybersecurity certification where required, otherwise the Class II route |
The lists are set out in the annexes and can be refined by implementing acts, so check the current text against the exact product type.
CRA timeline
The obligations phase in over three years from entry into force.
-
//
10 December 2024. The regulation entered into force.
-
//
11 June 2026. Rules for notifying the conformity assessment bodies that will carry out third-party assessments start to apply.
-
//
11 September 2026. Reporting of actively exploited vulnerabilities and severe incidents starts, including for products already on the market.
-
//
11 December 2027. The remaining obligations apply, including the essential requirements and CE marking for products placed on the market from that date.
What the CRA means for industrial hardware buyers
Most industrial products bought today will still be in service after December 2027, so CRA readiness is already a reasonable question to put to suppliers. Useful points to ask about are the support period, how firmware and BIOS updates are delivered, whether an SBOM is available and whether the product follows a secure development process such as IEC 62443-4-1.
Hardware features make several Annex I requirements easier to meet. Secure Boot protects the integrity of the boot chain, a TPM stores keys and measurements, and signed firmware updates support the update obligation. Many of our industrial PCs list TPM 2.0, and our managed industrial switches list security features such as IEEE 802.1X, SSH, HTTPS and SNMPv3 on most models. Those features support compliance, but conformity is a matter for each product’s manufacturer and its documentation.
In the UK, the CRA does not apply in Great Britain, but UK businesses that sell products into the EU must meet it for those products. UK law has its own regime for consumer connectable products under the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, and the Cyber Security and Resilience Bill updates the NIS rules for operators. Check the current position, because the UK rules are still developing.
Quick answers on the Cyber Resilience Act
The Cyber Resilience Act: common questions
When does the Cyber Resilience Act apply?
In stages. It entered into force on 10 December 2024. Vulnerability and incident reporting applies from 11 September 2026, and most other obligations from 11 December 2027.
Does the Cyber Resilience Act apply in the UK?
Not in Great Britain, but it applies to UK exports. A UK manufacturer selling into the EU must meet the CRA for those products, usually working with an EU importer or authorised representative.
What is the 24-hour deadline in the CRA?
The early warning for exploited vulnerabilities. Manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, followed by a notification within 72 hours.
Is there a Cyber Resilience Act certification?
Not as a separate certificate for most products. Conformity is shown with the CE marking. Important Class II and critical products need a notified body or EU cybersecurity certification.
Which standards support CRA compliance?
Harmonised standards are still being finalised. European standards bodies are preparing them, and IEC 62443-4-1 and 4-2 are widely used as reference points for industrial products in the meantime.
We build and configure industrial computers and switches from manufacturers who publish firmware updates and lifecycle information, and we pass that documentation on with every system so your CRA assessment has what it needs.