Regulation (EU) 2024/2847 (the Cyber Resilience Act) introduces binding single-market standards for hardware and software products. Its enforcement operates on a strict legislative timeline: mandatory reporting of actively exploited vulnerabilities and severe security incidents takes effect on 11 September 2026. The full body of product cybersecurity requirements, manufacturer duties, and CE marking obligations applies across the European Union from 11 December 2027.
1. Conformity Assessment Tiers: Default, Class I, and Class II
Under Chapter III and Annexes III & IV of Regulation (EU) 2024/2847, products with digital elements are structured into distinct regulatory tiers depending on their core functionality and systemic risk:
Default Products (General Scope)
Standard Software & Connected Devices
- Word processing applications, video games, ERP systems
- Standard smart home consumer electronics
- Internal business process software tools
Conformity Route: Internal control (Module A self-assessment) by the manufacturer.
Important Products — Class I (Annex III)
Identity, Network & System Tools
- Identity management systems and privileged access software
- Standalone browsers and password managers
- Network interfaces, VPN software, and routers
Conformity Route: Internal self-assessment is permitted ONLY if harmonised European standards or common specifications have been applied in full. If not, third-party assessment by a notified body is mandatory.
Important Products — Class II (Annex IV) & Critical
High-Risk Security Infrastructure
- Hardware firewalls, intrusion detection and prevention systems
- Industrial hypervisors, secure cryptoprocessors, tamper-proof chips
- Operating systems and smart meter security gateways
Conformity Route: Mandatory third-party conformity assessment by an accredited notified body (EU-type examination Module B+C or Full Quality Assurance Module H).
2. Core Manufacturer Obligations (Articles 13 & 14)
Manufacturers placing products with digital elements on the EU market must comply with detailed statutory obligations:
Security by Design and Default (Annex I)
Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on risks, delivered without known exploitable vulnerabilities, with secure default configurations.
Software Bill of Materials (SBOM) Generation
Under Article 13(7), manufacturers must identify and document software components and vulnerabilities, maintaining a machine-readable SBOM covering direct and transitive dependencies.
Lifecycle Vulnerability Handling & Support Period
Under Article 13(6), manufacturers must ensure vulnerabilities are handled effectively for the expected product lifetime, with security patch support provided for at least five years (except where the expected product lifetime is shorter).
Three-Stage Reporting Workflow (Article 14)
Effective 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents to the CSIRT designated as coordinator and ENISA:
- Within 24 Hours: Early warning notification indicating suspected cause and cross-border implications.
- Within 72 Hours: Vulnerability or incident notification detailing severity, impact, and known indicators of compromise.
- Within 14 Days: Final report submitted once corrective or mitigating measures are available (or within one month if remediation is ongoing).
3. Enforcement and Statutory Fines (Article 64)
Administrative fines under the CRA are categorized into explicit tiers under Article 64 of Regulation (EU) 2024/2847:
Statutory Fine Structure (Article 64)
- Non-compliance with Essential Requirements (Article 64(2)): Violations of essential cybersecurity requirements in Annex I or manufacturer duties under Articles 13 and 14 carry administrative fines of up to €15,000,000 or up to 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher.
- Violations of Other Obligations (Article 64(3)): Non-compliance with other manufacturer, importer, or distributor obligations carries fines of up to €10,000,000 or up to 2.0% of total worldwide annual turnover.
- Incorrect or Misleading Information to Authorities (Article 64(4)): Supplying incorrect, incomplete, or misleading information carries fines of up to €5,000,000 or up to 1.0% of total worldwide annual turnover.
- Market Surveillance Measures: National authorities may order the prohibition, restriction, or total recall of non-compliant products from the European market.
4. Engineering Roadmap: Preparing for Phased Deadlines
Software and hardware organizations commercializing in the EU must align their engineering pipelines today. Establishing automated SBOM generation, continuous dependency scanning, and formal vulnerability disclosure processes is essential to meet the 11 September 2026 notification obligations and the 11 December 2027 CE marking requirements.