The Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for hardware and software "products with digital elements" placed on the EU market, including vulnerability handling and incident reporting obligations for manufacturers.
2 deadlines tracked. Dates are the legally binding application dates.
Manufacturers that place a 'product with digital elements' on the EU market as a distinct product — connected/embedded hardware, distributable/installable software, firmware, and apps a manufacturer ships with a device — including small vendors and commercially-run open source. A pure browser-delivered SaaS with no distributed installable product is generally OUT of CRA scope per Recitals 11-12 (standalone remote data-processing solutions are excluded); the flags below can only approximate this distinction, so read this note rather than relying on the tags alone if you sell software purely as a hosted service.
Manufacturers, importers and distributors that place a 'product with digital elements' on the EU market as a distinct product — connected hardware, distributable/installable software, firmware, and client apps a manufacturer ships with a device — including IoT makers and app developers. A pure browser-delivered SaaS with no distributed installable product is generally OUT of CRA scope per Recitals 11-12 (standalone remote data-processing solutions are excluded); the flags below can only approximate this distinction, so read this note rather than relying on the tags alone if you sell software purely as a hosted service.