We email you if this date moves, is postponed, or its status changes — nothing else. Free, and independent of your company profile.
One rule, one address. Unsubscribe with one click from any email.
What changes
From this date every product with digital elements placed on the EU market must meet the essential cybersecurity requirements (secure defaults, no known exploitable vulnerabilities, security updates for the support period, SBOM), pass a conformity assessment and carry CE marking. Importers and distributors must check compliance.
Who is affected
Manufacturers, importers and distributors that place a 'product with digital elements' on the EU market as a distinct product — connected hardware, distributable/installable software, firmware, and client apps a manufacturer ships with a device — including IoT makers and app developers. A pure browser-delivered SaaS with no distributed installable product is generally OUT of CRA scope per Recitals 11-12 (standalone remote data-processing solutions are excluded); the flags below can only approximate this distinction, so read this note rather than relying on the tags alone if you sell software purely as a hosted service.
Sizes: micro, small, medium, large · Sectors: Software / SaaS, Hardware / electronics, Manufacturing · Applies if: We make connected hardware / devices
What to do
Classify each product (default, important class I/II, or critical) to know whether self-assessment is enough. Implement a secure development lifecycle, vulnerability handling and update policy, and generate an SBOM. Prepare technical documentation, the EU declaration of conformity and user security information. Define the product's support period (at least 5 years by default).
Manufacturers that place a 'product with digital elements' on the EU market as a distinct product — connected/embedded hardware, distributable/installable software, firmware, and apps a manufacturer ships with a device — including small vendors and commercially-run open source. A pure browser-delivered SaaS with no distributed installable product is generally OUT of CRA scope per Recitals 11-12 (standalone remote data-processing solutions are excluded); the flags below can only approximate this distinction, so read this note rather than relying on the tags alone if you sell software purely as a hosted service.