Testing laboratory and consultancy · Granges-Paccot

Book a call

Regulation (EU) 2024/2847

Cyber Resilience Act (CRA)

The Cyber Resilience Act sets cybersecurity requirements for almost all hardware and software products with digital elements sold in the EU. Vulnerability reporting has applied since 11 September 2026, the regulation as a whole from 11 December 2027. Säfeli assesses your product, sets up the required processes with you and prepares the technical documentation.

Book a 30-minute callSee our services
Vulnerability reporting
11.09.2026
Full application
11.12.2027
Reporting deadlines
24 h · 72 h
Maximum fine, or 2.5% of turnover
€15m

Who it is for

Who is affected

  • Hardware manufacturers

    Connected devices, machinery, electronic equipment, components with software.

  • Software publishers

    Software placed on the market as a product, apps supplied with a device.

  • Importers and distributors

    Check the CE marking, the documentation and the manufacturer’s obligations.

  • Component integrators

    Due diligence on third-party components and integrated open-source software.

Our services

Your CRA compliance, step by step

From scope to technical documentation, with the processes that must work throughout the support period.

Engineer examining the circuit board of a connected device
Scope and class

Are you affected? Product scope and class

Direct or indirect data connection, remote processing, sectoral exclusions, default product, important product of class I or II, or critical: we determine whether the CRA applies to your product and which conformity assessment procedure to follow.

What you receive

  • Scope analysis
  • Product class and assessment procedure
  • Compliance timeline

References

  • CRA, Art. 2, 3, 7 and 8
  • CRA, Annexes III and IV
Electronic chip protected by several layers of glowing shields
Essential requirements

Risk assessment and design requirements

Based on a cybersecurity risk assessment, we check every requirement of Annex I: secure by default, access control, encryption, integrity, data minimisation, resilience, attack surface, logging, secure data deletion.

What you receive

  • Documented cybersecurity risk assessment
  • Table of requirements and justifications
  • Gaps and design measures

References

  • CRA, Art. 13(2) to (4)
  • CRA, Annex I, Part I
Threat analysis (TARA)
Engineer reviewing an inventory of software components and a list of vulnerabilities
Vulnerabilities

Vulnerability handling and SBOM

Software bill of materials (SBOM), regular security testing, coordinated vulnerability disclosure policy, secure distribution of updates, reporting to ENISA: we set up with you the processes that must work throughout the support period.

What you receive

  • SBOM and component inventory
  • Coordinated vulnerability disclosure policy
  • Reporting process: 24 h, 72 h and final report

References

  • CRA, Annex I, Part II
  • CRA, Art. 14
Consultant comparing a technical file with a list of requirements
Documentation

Technical documentation and EU declaration

Description, architecture, risk assessment, vulnerability handling processes, justification of the support period, standards applied, test reports: we compile the Annex VII documentation and prepare the EU declaration of conformity.

What you receive

  • Technical documentation according to Annex VII
  • Information and instructions for the user
  • EU declaration of conformity

References

  • CRA, Annex VII
  • CRA, Art. 28

Also

Dates and obligations

The CRA in dates and obligations

The regulation entered into force on 10 December 2024. Its obligations apply in stages, and some also concern products already on sale.

  1. 10.12.2024Entry into force
  2. 11.06.2026Rules on notified bodies
  3. 11.09.2026Reporting of vulnerabilities and incidents
  4. 11.12.2027Full application

  • Actively exploited vulnerability

    Early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a corrective measure is available.

    CRA, Art. 14

  • Severe incident

    Early warning within 24 hours, notification within 72 hours, final report one month after the notification, via ENISA's platform.

    CRA, Art. 14 and 16

  • Support period

    Set according to the product's expected period of use, at least five years unless the period of use is shorter, with free security updates.

    CRA, Art. 13(8); Annex I, Part II

  • Retention

    Technical documentation and EU declaration of conformity kept for at least ten years, or for the support period if longer.

    CRA, Art. 13(13)

  • Products already on the market

    Subject to the CRA only if substantially modified after 11 December 2027, but the reporting obligation applies to all.

    CRA, Art. 69

  • Penalties

    Up to EUR 15 million or 2.5% of total worldwide annual turnover for non-compliance with the essential requirements and the main obligations.

    CRA, Art. 64

Sources: Regulation (EU) 2024/2847, Art. 13, 14, 16, 64, 69 and 71.

Annex I

The essential design requirements

Thirteen security properties, to be implemented on the basis of the risk assessment. Every requirement set aside must be justified.

  • Secure by default and kept up to date

    No known exploitable vulnerabilities when placed on the market, secure by default configuration, security updates, automatic by default.

    Annex I, Part I, point 2(a) to (c)

  • Access control

    Appropriate authentication and identity and access management, reporting of possible unauthorised access.

    Annex I, Part I, point 2(d)

  • Confidentiality and integrity

    Encryption of data at rest and in transit, integrity of data, commands, programs and configuration.

    Annex I, Part I, point 2(e) and (f)

  • Data minimisation, secure deletion

    Process only the data needed for the intended purpose, allow data and settings to be permanently removed.

    Annex I, Part I, point 2(g) and (m)

  • Availability and resilience

    Preserve essential functions, including against denial-of-service attacks, without disrupting other devices or networks.

    Annex I, Part I, point 2(h) and (i)

  • Attack surface and monitoring

    Limit exposed interfaces, reduce the impact of an incident, record and monitor relevant internal activity.

    Annex I, Part I, point 2(j) to (l)

Standards

CRA standards

The harmonised standards for the CRA are being drafted. In the meantime, EN 18031 and the IEC 62443 series provide a solid basis.

TypeStandardScope
CRAFprEN 40000-1-2*Principles, product risk management and lifecycle activities (in approval)
CRAprEN 40000-1-3*Vulnerability handling (in approval)
CRAprEN 40000-1-4*Generic security requirements (publication planned for 2027)
CRAETSI and CENELEC vertical standards*Important and critical products (publication planned from late 2026 to mid-2027)
REDEN 18031-1, -2 and -3:2024Cybersecurity of radio equipment, harmonised for the Radio Equipment Directive
IndustryIEC 62443-4-1:2018Secure product development lifecycle
IndustryIEC 62443-4-2:2019Technical security requirements for components
IoTETSI EN 303 645 V3.1.3Cybersecurity for consumer IoT

* Projects under way at CEN and CENELEC as at 1 October 2026; the timetable may change. Only publication of the reference in the Official Journal of the EU gives presumption of conformity with the CRA (Art. 27).

Product classes

Who assesses conformity?

The procedure depends on the product class. Säfeli is not a notified body: we prepare your product and your technical file, whatever the procedure.

  • Default product

    The vast majority of products. The manufacturer assesses conformity itself (internal control).

    CRA, Art. 32(1)

  • Important, class I

    E.g. routers, operating systems, password managers, security cameras, smart locks, connected toys. Internal control only when harmonised standards are applied in full.

    CRA, Art. 32(2); Annex III

  • Important, class II

    E.g. hypervisors, firewalls, intrusion detection systems, tamper-resistant microcontrollers. Third-party assessment mandatory.

    CRA, Art. 32(3); Annex III

  • Critical

    Hardware devices with security boxes, smart meter gateways, smartcards. European certification or the class II procedures.

    CRA, Art. 8 and 32(4); Annex IV

Our approach

Your CRA compliance in four steps

  1. Discovery call

    Your product, its connections, your markets and your timeline. 30 minutes.

  2. Gap analysis

    Scope, class, essential requirements, existing processes.

  3. Compliance work

    Risk assessment, design measures, SBOM, vulnerability process, testing.

  4. Technical file

    Technical documentation, instructions and EU declaration of conformity.

Swiss market

The CRA and Switzerland

The CRA applies to every product sold in the EU, including by a Swiss manufacturer. In Switzerland, the Federal Council decided on 25 September 2026 to create a federal cybersecurity act modelled on the CRA, with a draft to be put out for consultation by June 2027: preparing for the CRA also means preparing for future Swiss law.

Source: Federal Office for Cybersecurity (BACS), press release of 25.09.2026.

Frequently asked questions

Frequently asked questions on the Cyber Resilience Act

Does your product raise a specific question? Ask an engineer directly.

Book a call
What is a product with digital elements?

A hardware or software product, including its remote data processing solutions and components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network. The remote processing covered is the processing without which the product could not perform one of its functions.

Sources: Regulation (EU) 2024/2847, Art. 2(1) and Art. 3

My product is already on sale: what do I need to do?

Products placed on the market before 11 December 2027 are subject to the CRA only if they are substantially modified afterwards. However, the obligation to report actively exploited vulnerabilities and severe incidents has applied to all products since 11 September 2026. New versions and new products must comply from 11 December 2027.

Sources: Regulation (EU) 2024/2847, Art. 14, 69 and 71

What is an SBOM?

A software bill of materials: the machine-readable list of the product's software components, covering at least its top-level dependencies. It tells you quickly whether a published vulnerability affects you. It is part of the technical documentation and must be provided to the authority upon a reasoned request; you are not required to make it public.

Sources: Regulation (EU) 2024/2847, Annex I, Part II, point 1; Annex VII, point 8

Is a risk assessment required?

Yes. The manufacturer assesses the cybersecurity risks of its product, documents the assessment and updates it throughout the support period. It takes into account the intended purpose and reasonably foreseeable use, the conditions of use and the expected period of use, and states which requirements of Annex I apply and how they are implemented.

Sources: Regulation (EU) 2024/2847, Art. 13(2) to (4)

Are there already harmonised standards for the CRA?

They are in preparation: on 3 February 2025 the Commission issued a standardisation request for 41 standards, horizontal and vertical. According to the provisional timetable of the European standardisation organisations, the first are expected in 2026 and the generic requirements in 2027. Presumption of conformity applies only once the reference is published in the Official Journal of the EU.

Sources: Implementing Decision C(2025) 618 (M/606); Regulation (EU) 2024/2847, Art. 27

Does the CRA also concern importers and distributors?

Yes. Importers and distributors check in particular that the product bears the CE marking, that the documentation is available and that the manufacturer has met its obligations. Anyone who places a product on the market under their own name, or substantially modifies it, becomes the manufacturer.

Sources: Regulation (EU) 2024/2847, Chapter II

Does the CRA apply in Switzerland?

Not as such, but it applies to every product sold in the EU, including by a Swiss manufacturer. In Switzerland, the Federal Council decided on 25 September 2026 to create a federal cybersecurity act modelled on the CRA; a draft is to be put out for consultation by June 2027.

Sources: Federal Office for Cybersecurity (BACS), press release of 25.09.2026

Book a call

Tell us about your product

Book a 30-minute slot with an engineer directly. No back-and-forth by email: you choose the time, we prepare the call.

Choose a time slot

Contact details

Address
Säfeli Sàrl
Route d'Englisberg 3
1763 Granges-Paccot
Languages
French, German, English
Book a call