Security of software products
Short label: CRA
Meaning
The Cyber Resilience Act sets cybersecurity duties for covered products with digital elements, including software and connected equipment.
Why it matters
Responsibilities depend on the product and your role, such as manufacturer, importer or distributor.
What you can do
Identify your products and responsibilities, plan vulnerability handling and keep component records. Check the official source for scope and phased application dates.
Services that can help
Custom Software and Sovereign Code support reviewed changes, component records and maintenance workflows. Workshops explain the responsibilities relevant to your products.
Official reference — CRA art. 13
When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.
— Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 13(1)
Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I.
— Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 13(8)
A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.
— Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 14(1)
Covered manufacturers have duties for secure design, vulnerability handling and support. Check product scope and the phased application dates; reporting under Article 14 has a different start date from most product obligations.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.