EU CRA

Who it applies to

Manufacturers, importers and distributors of products with digital elements made available on the EU market, with some product categories (for example those covered by sector rules such as medical devices) excluded and stricter conformity assessment for important and critical products.

Key requirements

• Meet essential cybersecurity requirements: secure by default, protection against unauthorised access, minimised attack surface and data, and security updates.
• Vulnerability handling for the support period, including a software bill of materials and a coordinated vulnerability disclosure policy.
• Report actively exploited vulnerabilities and severe incidents through the single reporting platform.
• Conformity assessment and CE marking before placing a product on the market.
• Technical documentation and clear security information for users.

Breach and incident notification

For actively exploited vulnerabilities and severe incidents affecting a product: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later, sent to the designated CSIRT and ENISA.

Penalties

Fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements; lower tiers apply to other breaches.

Go deeper