EU Cyber Resilience Act: A Guide for Software Companies
Last updated: 5 November 2026. This article is general information, not legal advice.
For years, software security in Europe was largely a matter of good practice and contracts. The EU Cyber Resilience Act changes that by making cybersecurity a legal requirement for products with digital elements sold in the EU, from apps and desktop software to connected devices. The regulation entered into force in December 2024, but its obligations are phased in. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents within strict deadlines. By 11 December 2027, the full requirements apply, including secure-by-design obligations, vulnerability handling throughout a product's support period, and CE marking. Software companies inside and outside the EU need to understand where they stand.
Key Dates
- 10 December 2024: the CRA entered into force.
- 11 June 2026: rules for conformity assessment bodies began to apply.
- 11 September 2026: the reporting obligations for actively exploited vulnerabilities and severe incidents began to apply.
- 11 December 2027: the remaining obligations apply, including the essential cybersecurity requirements, conformity assessment, and CE marking.
Who the CRA Applies To
The CRA applies to products with digital elements made available on the EU market as part of a commercial activity. This includes software and hardware that connects, directly or indirectly, to a device or network, as well as remote data processing solutions that are essential to a product's functions. Manufacturers carry most of the obligations, while importers and distributors have their own duties. A distributor or importer that sells a product under its own name, or substantially modifies it, is treated as the manufacturer.
Because the regulation is tied to the EU market, location does not provide an exemption. Software companies based in the UK, Türkiye, the Gulf, or elsewhere are affected when they sell in-scope products to customers in the EU. Some sectors already covered by specific EU rules, such as medical devices, motor vehicles, and civil aviation, are excluded, and free and open-source software supplied outside a commercial activity is treated differently.
What About SaaS?
Pure software as a service, delivered over the internet without local installation and not marketed as a distinct product, is generally outside the CRA, although it may fall under other regulations such as NIS2 or DORA. The line is not always obvious, however. Software that users download and install, such as a mobile app, is in scope. If that app only works with the vendor's back end, the remote service may be treated as part of the product, because it is essential to its core functionality. Cloud features that are optional add-ons are more likely to remain outside the CRA. Companies with a mix of installed software and cloud services should assess each product carefully.
The Reporting Obligations in Force Since September 2026
Two types of events must be reported: actively exploited vulnerabilities, where there is reliable evidence that an attacker has exploited the flaw, and severe incidents affecting the security of the product. For both, the deadlines are demanding:
- Early warning within 24 hours of becoming aware of the vulnerability or incident.
- Notification within 72 hours with more detailed information.
- Final report no later than 14 days after a fix or mitigation is available for an exploited vulnerability, or within one month after the notification for a severe incident.
Reports are submitted through a single reporting platform to the coordinating national CSIRT and to ENISA, the EU cybersecurity agency. Manufacturers must also inform affected users about the issue and any measures they can take. Micro and small enterprises are not fined for missing the 24-hour early warning deadline, but the reporting duty still applies to them.
What Applies from December 2027
From 11 December 2027, products in scope must meet the CRA's essential cybersecurity requirements. In practice, this means designing products to be secure by default, avoiding known exploitable vulnerabilities at release, handling and fixing vulnerabilities throughout a defined support period, which generally must be at least five years unless the product is expected to be used for less time, providing security updates, documenting the software components the product contains, and carrying out a conformity assessment before applying the CE mark. Products classified as important or critical face stricter assessment procedures.
Penalties
The CRA sets significant fines. Breaches of the essential requirements and the core manufacturer obligations, including reporting, can lead to fines of up to 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher. Other breaches carry lower maximum fines. How and when national authorities enforce these penalties during the transition period should be confirmed with legal advisors.
How Software Teams Should Prepare
- Map your products. List which products are sold in the EU and determine whether each one, including its back-end services, falls within scope.
- Set up 24-hour vulnerability handling. Define who monitors for exploited vulnerabilities and incidents, who decides whether an event is reportable, and how reports are submitted within the deadlines.
- Know your components. Maintain a software bill of materials for each product so you can quickly assess exposure when a vulnerability is reported in a dependency.
- Publish a disclosure policy. Give security researchers and customers a clear way to report vulnerabilities to you.
- Build security into development. Automated dependency scanning, secure defaults, code review, and a reliable update process are the foundation of the 2027 requirements.
- Define support periods. Decide how long each product will receive security updates and plan the resources to deliver them.
Frequently Asked Questions
What is the EU Cyber Resilience Act?
The Cyber Resilience Act is an EU regulation that sets mandatory cybersecurity requirements for products with digital elements sold in the EU, including software and connected hardware. It covers how products are designed, how vulnerabilities are handled, and how security incidents are reported.
When did CRA reporting become mandatory?
The reporting obligations for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026. The full set of requirements applies from 11 December 2027.
Does the CRA apply to companies outside the EU?
Yes, when they place in-scope products on the EU market. The regulation is tied to where products are sold, not where the manufacturer is based.
Does the CRA apply to SaaS?
Pure SaaS that is not installed locally and not marketed as a distinct product is generally outside the CRA. However, remote services that are essential to an installed product, such as the back end of a mobile app that cannot work without it, may be in scope.
What are the CRA reporting deadlines?
An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days after a fix is available for an exploited vulnerability, or within one month after the notification for a severe incident.
What are the penalties under the CRA?
For breaches of the essential requirements and core manufacturer obligations, fines can reach 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher. Lower maximum fines apply to other breaches.
Conclusion
The Cyber Resilience Act turns software security into a legal obligation for products sold in the EU. The 24-hour reporting duty is already in force, and the full requirements arrive in December 2027, which is closer than it seems for teams that need to change how they build, document, and maintain their products. Start by mapping what is in scope, setting up fast vulnerability handling, and strengthening security in your development process. If you build software for the European market and need help putting secure development, dependency management, and vulnerability handling in place, our team can help you prepare.