---
title: "Security of software products"
description: "Security of software products, family Build, CRA art. 13"
url: https://www.alt-f1.be/en/table/cra/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Security of software products

Short label: CRA

Family: Build · CRA art. 13
<a id="meaning"></a>

## Meaning

The Cyber Resilience Act sets cybersecurity duties for covered products with digital elements, including software and connected equipment.

<a id="why"></a>

## Why it matters

Responsibilities depend on the product and your role, such as manufacturer, importer or distributor.

<a id="actions"></a>

## What you can do

Identify your products and responsibilities, plan vulnerability handling and keep component records. Check the official source for scope and phased application dates.

## Services that can help

Custom Software and Sovereign Code support reviewed changes, component records and maintenance workflows. Workshops explain the responsibilities relevant to your products.

- [Custom Software](https://www.alt-f1.be/en/custom-software.md)
- [Sovereign Code](https://www.alt-f1.be/en/sovereign-code.md)
- [Workshops](https://www.alt-f1.be/en/workshops.md)

## Official reference — CRA art. 13

> When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.
>
> — Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 13(1)

> Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I.
>
> — Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 13(8)

> A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.
>
> — Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 14(1)

**What this reference concerns:** Covered manufacturers have duties for secure design, vulnerability handling and support. Check product scope and the phased application dates; reporting under Article 14 has a different start date from most product obligations.

[Read the article on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13) · Official text, quoted from the Official Journal of the EU