What is the EU Cyber Resilience Act (CRA)?

The Cyber Resilience Act (Regulation (EU) 2024/2847) is an EU law that sets mandatory cybersecurity requirements for hardware and software products (the law calls them 'products with digital elements') that are made available on the EU market and whose intended or reasonably foreseeable use includes a direct or indirect data connection to another device or network, for example over the internet, Bluetooth, USB, or by exchanging files. It requires manufacturers to build products that are secure by design, handle and report vulnerabilities, provide security updates for a defined support period, and keep technical documentation including a software bill of materials.

Does the CRA require an SBOM?

Yes. The CRA requires manufacturers to produce and maintain a software bill of materials (SBOM) in a commonly used, machine-readable format such as CycloneDX or SPDX as part of their technical documentation. The SBOM must cover at least the top-level dependencies of the product and support the manufacturer's obligation to identify and address vulnerabilities in third-party and open source components. For hardware products, it covers the software and firmware on the device; the CRA does not require a list of physical parts.

What are the penalties for CRA non-compliance?

Breaching the CRA's essential cybersecurity requirements (Annex I) or the manufacturer obligations in Articles 13 and 14, including vulnerability reporting, can result in administrative fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher. Breaching other obligations, such as those of importers and distributors, or supplying incorrect or misleading information to authorities, carries lower but still significant fines. Beyond fines, non-compliant products can be ordered withdrawn from the EU market.

Does the CRA apply to companies based outside the EU?

Yes. The CRA applies based on where a product is placed on the market, not where its maker is based. Any company that makes a product with digital elements available on the EU market, whether directly or through importers and distributors, must meet the CRA's requirements. Manufacturers outside the EU typically work through EU-established importers, who carry their own duties to verify conformity before a product reaches the market, and may appoint an authorized representative in the EU.

Is my data private when I use this assessment?

Your answers are scored in your browser and stay on your device unless you choose to unlock the full report or book a call from it. In that case we receive the contact details you enter and a link that encodes your answers, so we can send the report back to you and prepare for the conversation. If you accept analytics cookies, we also record summary results such as your grade and scope result, never your contact details.

Does the CRA apply to free or open source products?

Often, yes. The CRA covers products made available as part of a commercial activity, and that includes free products that support a business, such as a free tier, a free CLI for a paid service, or open source you sell support for. Open source released with no commercial activity around it is outside the manufacturer duties, though organizations that sustain such projects for commercial use may have lighter duties as open-source software stewards. Open source components you build into a commercial product are your responsibility as the manufacturer.

Does the CRA apply to SaaS?

A service customers use only through a browser is generally outside the CRA, though NIS2 may apply depending on your sector and size. But installable software that works with the service, such as a CLI, desktop agent, mobile app, or SDK, is a product in its own right, and the cloud back end it depends on can then be in scope as remote data processing.

Free EU CRA Compliance Tool

Cyber Resilience Act Readiness Assessment

Find out whether the CRA applies to you, then check your software supply chain and vulnerability reporting against it, one plain-language question at a time. Get a prioritized 30/60/90-day plan and an executive-ready report.

About 10 minutes Scope & product class screen SBOM & supply chain coverage 30/60/90-day plan Scored in your browser

What the CRA Requires, in Brief

The core obligations for in-scope hardware and software products. Vulnerability reporting (Article 14) has applied since September 11, 2026; the rest must be met by December 11, 2027, before CE marking.

Secure by design and secure by default

Ship with a minimized attack surface, a secure default configuration, protection for the confidentiality and integrity of data (for example encryption and tamper detection), and essential functions that stay available under attack. This assessment covers the default configuration; the rest needs a product security review.

24-hour vulnerability reporting

Send an early warning of actively exploited vulnerabilities and severe incidents within 24 hours, through ENISA's single reporting platform to your national cybersecurity team (CSIRT). This reporting duty has applied since September 11, 2026; the coordinated vulnerability disclosure policy behind it is required by December 11, 2027.

SBOM & supply chain governance

Maintain a machine-readable SBOM (for example CycloneDX or SPDX) covering at least top-level dependencies, including the software and firmware in hardware products, and monitor every component, open source and commercial, for new vulnerabilities.

Security updates across the lifecycle

Provide free security updates, with advisories, for a support period that matches how long the product is expected to be in use: at least five years unless expected use is shorter. Where technically feasible, ship them separately from feature updates.

About This Assessment

This assessment focuses on the software supply chain and vulnerability reporting obligations of the EU Cyber Resilience Act (Regulation (EU) 2024/2847): scope, a product classification screen, vulnerability handling and 24-hour reporting, SBOM and component due diligence, and security updates across the support period. Each question is written in plain language and shows the CRA article or annex it maps to. The CRA's full list of product security requirements (Annex I, Part I) calls for a separate product security review.

The readiness score is severity-weighted: each question counts in proportion to how central the requirement is to CRA compliance, so the 24-hour reporting mandate (Article 14) and the SBOM requirement move the score more than lifecycle details. Follow-up questions only appear when they apply, and only the questions you were asked count toward your score. A few requirements are legal must-haves; if one is missing (for example, no vulnerability response process or no SBOM), it acts as a knockout that caps the grade regardless of your score elsewhere. Scoring runs in your browser, and your answers stay on your device unless you unlock the full report or book a call from it, in which case we receive a link that encodes them. This is directional guidance for planning, not legal advice; consult qualified counsel for a formal conformity determination.

Official sources

Last reviewed September 24, 2026Maintained by the FOSSA software supply chain compliance team

Cyber Resilience Act Compliance FAQ

Plain-English answers to the questions engineering and security leaders ask about the EU CRA.

Go Deeper on the Cyber Resilience Act

Focused guides to the CRA requirements that most often trip teams up.

Get Started with FOSSA

Start managing your dependencies, licenses, and vulnerabilities today.