The Cyber Resilience Act (CRA) for U.S.-Based Companies

The EU Cyber Resilience Act (CRA) isn't just a European concern. If your company sells software or connected products into the EU market, the CRA applies to you, no matter where you're headquartered. This includes the many businesses based in the United States that sell products in the EU.

The CRA's vulnerability and incident reporting obligations took effect in September 2026, and full compliance will be required by December 2027. This means organizations must juggle active processes for discovering and reporting vulnerabilities with preparation for the obligations that take effect next year. The starting point for many companies, however, is figuring out whether the CRA applies to your product(s) in the first place.

We invite you to join CRA expert (and contributor to the development of multiple CRA standards) Valerie Aurora for a webinar that will cover practical next steps for U.S.-based organizations. We'll discuss how to determine whether your products are in scope, what the 24-hour, 72-hour, and final vulnerability reports require, how to navigate open questions around CSIRTs and authorized representatives, and how to build the SBOM and vulnerability-handling foundations you'll need before 2027.

You'll learn:

• How to determine whether your products fall under the CRA and which product classification and conformity assessment path applies.
• What the September 2026 reporting obligations require, including what counts as an actively exploited vulnerability and a severe security incident.
• How U.S. companies should approach choosing a CSIRT, appointing authorized representatives, and registering for the Single Reporting Platform.
• What manufacturers owe the open source projects they depend on, and how CRA responsibilities differ for commercial companies and non-profit OSS stewards.
• How to build the SBOM, documentation, and continuous vulnerability-monitoring practices you'll need for 2027 CE marking.