We build software or smart devices, does the Cyber Resilience Act hit us?
The Cyber Resilience Act (CRA) is EU product law for products with digital elements. It targets manufacturers, importers and distributors of hardware and software, with phased obligations.
Try this first
- 1Determine if your product is in CRA scope. Software you place on the market commercially and hardware with digital elements typically fall within it.
- 2Build a security-by-design dossier: threat analysis, vulnerability handling, secure update mechanism, and an SBOM for your components.
- 3Set up a coordinated vulnerability disclosure process with a clear contact channel and an internal SLA for follow-up.
- 4Plan product security across the product lifetime. Deliver updates during the support window and clearly inform users when support ends.
- 5Track the official timeline via the European Commission. CRA entered into force in December 2024; reporting duty for actively exploited vulnerabilities applies from 11 September 2026, full application from 11 December 2027.
When to bring us in
Security and critical products carry stricter requirements. If yours is one, get a specialist to run the conformity assessment.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- What changes with the Dutch Cyber Security Act?The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.