Knowledge Center
Cyber Resilience Act guides for manufacturers.
Answers first, then detail, with links to the official text. More guides are available in Slovenian.
CRA reporting obligations: 24 hours, 72 hours and final report
Since 11 September 2026, manufacturers must notify actively exploited vulnerabilities and severe incidents that affect the security of their products. An early warning is due within 24 hours…
CRA SBOM requirements: what is actually required?
The CRA requires an SBOM in a commonly used and machine-readable format that covers at the very least the top-level dependencies of the product. It must be part of documented vulnerability h…
CRA technical documentation (Annex VII) checklist
The CRA technical documentation must contain at least the information listed in Annex VII, as applicable to the product. It must be drawn up before the product is placed on the market and ke…
CRA timeline: what applies in 2026 and 2027
The CRA entered into force on 10 December 2024. Chapter IV on conformity assessment bodies has applied since 11 June 2026, reporting obligations under Article 14 have applied since 11 Septem…
CRA vulnerability management requirements
The CRA requires manufacturers to handle vulnerabilities effectively for the whole support period, following Annex I Part II: identify and document them, remediate without delay, test regula…
Cyber Resilience Act (CRA): what it is and what it requires
The Cyber Resilience Act (CRA) is Regulation (EU) 2024/2847. It sets mandatory cybersecurity requirements for hardware and software products with digital elements made available on the EU ma…
Does the Cyber Resilience Act apply to your product?
The CRA applies to products with digital elements made available on the EU market that have a direct or indirect logical or physical data connection to a device or network, unless an exclusi…
Will your product be CRA prepared?
CRA reporting obligations have applied since 11 September 2026. Most CRA requirements apply from 11 December 2027. Write to us in English or Slovenian.