The Cyber Resilience Act (CRA) is coming.
Is your product ready?

The CRA has been adopted at EU level and is being rolled out in phases.

• The first deadline is 11 September 2026, when reporting obligations come into effect.
• Full compliance is required from 11 December 2027.

That may sound like there is time to spare, but embedding security into your development and support processes is not a quick fix. The earlier you start, the more room you have to get it right.

It depends on the type of software. If your software needs to be installed locally and requires a network connection, it most likely falls within scope. Pure SaaS products are generally not covered by the CRA, though they may fall under NIS2. The boundary is not always clear-cut, and the EU is still working on technical guidance to clarify it. If you are unsure, contact us and we’ll work it out together.

It depends on how the software is distributed. Open source software developed and shared on a non-commercial basis is generally exempt from the CRA. However, if you monetise the software, offer paid support, or integrate it into a commercial product, you may fall within scope. The boundary is not always straightforward, and the EU is still working on technical guidance to clarify edge cases. If your organisation distributes or builds on open source software commercially, it is worth assessing your position carefully.

ISO 27001 is a strong foundation, but it is not sufficient on its own. It focuses on how your organisation manages information security. The CRA goes further by setting specific requirements for the products you build and sell. That includes how you design them, how you handle vulnerabilities after launch, and how you document and prove your compliance.

That said, ISO 27001 and the CRA complement each other well. The 2022 version of ISO 27001 includes a number of Annex A controls specifically around secure development, covering areas such as secure coding practices, protection of test environments, and security in development and support processes. These controls provide a useful starting point, but the CRA expects a more product-specific and documented approach that goes beyond what ISO 27001 requires on its own.

The two regulations target different things. NIS2 focuses on how organisations protect their own systems, networks, and operations. The CRA focuses on the products they build and sell.

If your organisation falls under NIS2 and also develops or distributes products with digital elements, both regulations apply to you. In practice, the two regulations complement each other. Strong governance and risk management under NIS2 provides a solid foundation for CRA compliance, but the CRA adds product-specific obligations that NIS2 does not cover.

Non-compliance can result in fines, enforcement measures, or being barred from selling your product in the EU market. Beyond the legal consequences, it can also affect your relationships with customers and partners, as well as your insurance coverage. More fundamentally, the CRA is designed to raise the bar for all digital products in Europe. Organisations that treat it as a strategic priority rather than a legal obligation will be better placed, both commercially and reputationally.

Compliance under the CRA is demonstrated primarily through the CE marking, combined with a documented conformity assessment. This means you need to be able to show which risk assessment you carried out, which security measures you put in place, how vulnerabilities are monitored and addressed, and how security updates are made available. The CRA also requires that certain information is made publicly available, such as relevant risks and security aspects of your product. In short, compliance is not just about what you do. It is about being able to prove it, clearly and consistently.

Cingulum can assist you with all these compliance documents. 

From 11 September 2026, organisations must report actively exploited vulnerabilities and serious incidents that affect the security of their products to the relevant national authorities. The reporting timeline is strict: an early warning must be submitted within 24 hours of becoming aware of the incident, followed by a more detailed notification within 72 hours. This requires clear internal processes well before the deadline arrives. Many organisations underestimate how much structural preparation this takes, from defining responsibilities to setting up the right monitoring and documentation processes.

Yes, if your products are placed on the EU market, the CRA applies regardless of where your organisation is based. The regulation follows the product, not the producer. If you sell to customers in the EU, import into the EU, or distribute under your own brand within the EU, you are in scope. Many non-European manufacturers and software developers are affected by this, even if they have no physical presence in Europe.