Guide
Cyber Resilience Act Guide: Reporting, Requirements and Open Source
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for hardware and software products with digital elements sold in the EU. Reporting duties already apply; the product requirements follow in December 2027.
At a glance
| Legal form | Regulation: applies directly in every member state |
| Reporting | Actively exploited vulnerabilities and severe incidents, since 11 September 2026: 24 hours, 72 hours, final report |
| Requirements | Annex I security properties and vulnerability handling, from 11 December 2027 |
| Support period | At least five years, unless the product is expected to be used for less |
| Fines | Up to €15 million or 2.5% of worldwide turnover for Annex I and Articles 13 and 14 |
Each point is explained, with its legal source, in the guides below.
What applies now
Product requirements
Cyber Resilience Act Requirements: The Annex I Checklist for Manufacturers
Every Annex I requirement in plain language, the manufacturer duties in Article 13 (risk assessment, support period, SBOM), product classes and which conformity assessment you need.
11 min read
The Cyber Resilience Act and Open Source: Maintainers, Stewards and Companies Using FOSS
When open-source software is in scope of the CRA, what the light-touch regime for open-source software stewards requires, and what manufacturers must do with the open-source components in their products.
9 min read
Cyber Resilience Act for Importers and Distributors: Articles 19 to 23
Who counts as an importer or distributor, the checks before you sell, what to do about vulnerabilities and non-conforming products, the 10-year records, when you become the manufacturer, and the fines.
8 min read
How it fits with NIS2
Related articles
How to Scope a Penetration Test (and What to Ask the Tester)
Objectives, test types, targets and exclusions, rules of engagement, authorisation, what the report must contain, and the questions to ask before you sign.
9 min read
How to Write an Incident Response Plan (Free Template)
Step-by-step guide to creating an incident response plan that meets NIS2 and GDPR notification requirements. Includes a free policy generator.
10 min read
Free tools
Templates
Incident Response Playbook · $39.00
Master IR plan, six scenario playbooks, regulatory notification templates.
Get the templates →Cybersecurity Starter Pack for Startups · $44.00
Patch and vulnerability procedure, asset inventory, pentest scoping, 90-day roadmap.
Get the templates →Other guides: NIS2 · DORA · GDPR · AI Act and AI agents · Security for startups and SMEs
This guide is for informational purposes only and does not constitute legal advice. Last updated: October 2026.