EU Cyber Resilience Act (2024)

As of 1 October 2026. Information only, not legal advice – see the disclaimer.

The Cyber Resilience Act sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. Manufacturers must design, develop and produce such products in accordance with essential cybersecurity requirements, handle vulnerabilities throughout a defined support period and report actively exploited vulnerabilities and severe incidents. Conformity is indicated by the CE marking. The Regulation is referred to in debates on reducing the vulnerabilities that cyber operations, including State-sponsored operations, exploit.

• Art. 13 and Annex I – Obligations of manufacturers and essential cybersecurity requirements, including secure-by-default configuration, protection against unauthorised access, and vulnerability handling with security updates.
• Art. 13(8) – Support period reflecting the expected use time of the product, in principle at least five years.
• Art. 14 – Reporting of actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and ENISA: early warning within 24 hours, notification within 72 hours, final report; information of affected users.
• Art. 16 – Single reporting platform established by ENISA.
• Art. 64 – Administrative fines of up to EUR 15 million or 2.5 % of total worldwide annual turnover for infringements of the essential requirements and of Arts. 13 and 14.

The Regulation does not address attribution or State conduct. It places security obligations on manufacturers and creates a Union-wide reporting system for exploited vulnerabilities. Its requirements are taken into account in the assessment of defectiveness under the EU Product Liability Directive (Art. 7(2) of that directive).

• 2024-12-10: Entry into force.
• 2026-06-11: Provisions on notification of conformity assessment bodies apply.
• 2026-09-11: Reporting obligations under Art. 14 apply; ENISA launches the CRA single reporting platform (ENISA).
• 2027-12-11: General application (scheduled).

• product_liability
• nis2_cer
• ict_norms
• private_actors

• Regulation (EU) 2024/2847 (EUR-Lex), accessed 2026-10-01
• ENISA: The CRA Single Reporting Platform is launched, accessed 2026-10-01

• 2026-10-01: Entry created.