What is the Cyber Resilience Act, in plain terms?

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is the EU law on the security of products with digital elements. These are hardware and software that connect to a device or a network, from routers and cameras to apps and operating systems sold in the EU. It places duties on manufacturers, with lighter ones on importers and distributors. Products must be designed with security in mind, ship without known exploitable vulnerabilities and with secure default settings, and receive security updates during a support period the manufacturer defines. Manufacturers must handle vulnerabilities in a structured way, document the components they use and report actively exploited vulnerabilities and severe incidents, as Article 14 sets out. Some product categories, such as security products and network equipment, face stricter conformity assessment, and products that meet the requirements carry the CE marking. The dates on which each part applies are set in its final provisions. If you only buy and use products, the CRA mainly helps you: expect clearer support periods and update promises from suppliers.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics