Cyber Resilience Act (CRA)

For anyone maintaining a product inventory, that is the scoping question to answer this month: not "which of our products will need CE marking in 2027", but "which products with digital elements do we have on the EU market right now, and who watches them for active exploitation from 11 September".

Who is a manufacturer?

Wider than people expect, and this is where a financial institution gets caught.

A manufacturer develops or manufactures a product with digital elements, or has one designed, developed or manufactured and markets it under its own name or trademark.

Then Article 21 closes the obvious escape:

An importer or distributor shall be considered to be a manufacturer for the purposes of this Regulation and shall be subject to Articles 13 and 14, where that importer or distributor places a product with digital elements on the market under its name or trademark or carries out a substantial modification of a product with digital elements already placed on the market.

So a bank that takes a vendor's product, puts its own brand on it and ships it to customers is a manufacturer, with the full Article 13 product obligations and, from 11 September 2026, the Article 14 reporting duty. So is anyone making a substantial modification to a product already on the market.

The scope trigger itself is broad. Article 2(1) catches products with digital elements made available on the market whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. The Commission lists mobile apps among the in-scope default-category products.

What is out of scope

Article 2 exclusions: medical devices and in-vitro diagnostics; motor vehicles; civil aviation; marine equipment; spare parts replacing identical components to original specifications; and products developed exclusively for national security, defence or classified information processing. The Commission may limit or exclude further categories by delegated act where other Union rules achieve an equal or higher level of protection.

Software as a service and cloud. The line is drawn by the concept of a remote data processing solution: data processing at a distance for which the software is designed and developed by or on behalf of the manufacturer of the product. Recital 12 is the operative sentence: cloud solutions are remote data processing solutions only if they meet that definition, and "cloud services designed and developed outside the responsibility of a manufacturer … do not fall within the scope." In practice, standalone SaaS is outside the CRA and sits with NIS2 and DORA instead. Cloud-side components that the manufacturer designs and that the product needs to perform a core function are inside, as the product's remote data processing solution.

Open source. Free and open-source software not monetised by its manufacturers is not a commercial activity and is out of scope. Where it is supplied in the course of a commercial activity it is in. The Regulation creates a distinct actor, the open-source software steward, with a deliberately light regime under Article 24: establish and document a cybersecurity policy that supports secure development and effective vulnerability handling, cooperate with market surveillance authorities and provide that documentation on reasoned request, and comply with Article 14(1) reporting to the extent the steward is involved in developing the product. Stewards cannot be fined.

DORA, NIS2 and the AI Act. Neither DORA nor NIS2 disapplies the CRA. The Article 2 exclusions are sectoral product law only. DORA and NIS2 regulate entities and services; the CRA regulates products. A DORA-regulated bank that manufactures a product is subject to both, with separate reporting channels: the DORA chain to its financial supervisor, the CRA chain to the coordinating CSIRT and ENISA. The AI Act interacts differently, and in the manufacturer's favour: Article 12(1) provides that products in CRA scope classified as high-risk AI systems under Article 6 of Regulation (EU) 2024/1689, and meeting the CRA essential requirements, are deemed to comply with the AI Act's cybersecurity requirements. But Article 12(3) keeps important and critical products under the CRA's conformity assessment procedures. See the EU AI Act.

Free and open-source important products may use self-assessment if the technical documentation is made public.

The standards gap, and what it actually costs you

Standardisation request M/606 was accepted by CEN, CENELEC and ETSI on 3 April 2025. 41 standards were requested, with a work programme of 56 items (roughly 24 horizontal and 17 vertical, plus technical reports) and a target completion of 30 October 2026 for nearly all of them.

We found no CRA harmonised standard cited in the Official Journal as at 17 August 2026. The Commission's own implementation page still lists "first standardisation deliverables expected" in Q3 2026, with a further tranche in late 2027, and gives no citation. We state that as an absence of evidence rather than a hard zero, because we could not run a definitive Official Journal citation search. There is no indication any exist, though.

One caution worth carrying: a Commission announcement about "first EU standards on cybersecurity" concerned the Radio Equipment Directive delegated regulation, not the CRA. Vendor content conflates the two regularly.

What counts as a reportable event?

Article 14(1): any actively exploited vulnerability contained in the product that the manufacturer becomes aware of, notified simultaneously to the CSIRT designated as coordinator and to ENISA.

Article 14(3): any severe incident having an impact on the security of the product, on the same simultaneous basis.

ENISA's working definitions: an actively exploited vulnerability is one where there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. A severe incident negatively affects the product's ability to protect availability, authenticity, integrity or confidentiality, or enables the introduction or execution of malicious code in the product or a user's systems.

Where do you report, and can it be delayed?

Article 14(8) separately requires the manufacturer to inform impacted users, where appropriate in a structured, machine-readable format that is easily automatically processable.

Article 16 establishes a single reporting platform, with day-to-day operations managed and maintained by ENISA. Manufacturers report once: to the CSIRT of the Member State of their main establishment and simultaneously to ENISA, and that CSIRT shares it without delay with the CSIRTs of Member States where the product is made available.

Article 16(2) allows dissemination to be delayed "based on justified cybersecurity-related grounds" for a period strictly necessary. Commission Delegated Regulation (EU) 2026/881 of 11 December 2025, published 20 April 2026, sets the conditions: where the cybersecurity risks of dissemination outweigh its benefits (for example where a patch is expected within 72 hours), where a specific CSIRT has itself been affected by an incident casting doubt on its ability to keep the notification confidential, and where the platform itself is compromised. ENISA retains access to all notifications except in particularly exceptional circumstances during the 72-hour vulnerability window.

Micro and small enterprises may not be fined for missing the 24-hour deadline.

ENISA points manufacturers at the single reporting platform. NCSC-NL points them at mijn.NCSC.nl, using eHerkenning or SSOnRijk, and repeats the obligation to report without undue delay and in any event within 24 hours. Both are stated on primary sources. Establish which channel your CSIRT coordinator expects before 11 September, not during an incident.

Market surveillance and penalties

Member States designate one or more market surveillance authorities, and Chapter V applies alongside Regulation (EU) 2019/1020. An administrative cooperation group, ADCO, coordinates.

The Netherlands has not finished. The Uitvoeringswet verordening cyberweerbaarheid went to internet consultation on 10 March 2025, to the Raad van State on 18 July 2025, and was introduced in the Tweede Kamer on 18 December 2025. The government answered the parliamentary report on 23 April 2026. As at August 2026 it has not been adopted and is not in the Staatsblad, with the first reporting obligations twenty-five days away. The Regulation itself needs no transposition to apply, as the RDI notes; what the bill supplies is the national enforcement machinery.

Germany is further along and more useful to read. The BSI has chaired ADCO CRA since March 2026 and hosted the group in Berlin on 25 June 2026, with market surveillance authorities from thirteen countries and the Commission, setting up working groups including one on machine-readable data exchange formats. Its technical guideline TR-03183-1, published 5 August 2026, is an entry guide to the CRA with a risk-based method for selecting security measures, published in OSCAL machine-readable format; Part 2 covers SBOMs, whose minimum elements were updated on 29 July 2026, and Part 3 covers vulnerability reports and notifications.

What recently changed

5 August 2026: BSI published TR-03183-1 v1.0.0, the first substantial national technical guidance on meeting CRA requirements.

27 July 2026: the Commission published guidance C(2026) 5252 and its annex, framed as supporting timely implementation, covering scope, remote data processing solutions, free and open-source software, substantial modification, support periods, reporting and risk assessment, with 67 practical examples, use cases and flowcharts, aimed particularly at SMEs.

25 June 2026: ADCO CRA met in Berlin, thirteen countries plus the Commission.

11 June 2026: Chapter IV applied, opening notification of conformity assessment bodies. Member States have until 11 December 2026 to have notified sufficient bodies.

20 April 2026: Delegated Regulation (EU) 2026/881 published, setting the conditions for delaying dissemination of a notification.

1 December 2025: Implementing Regulation (EU) 2025/2392 published, giving the technical description of the Annex III and Annex IV product categories.

Will 11 September slip? There is no indication that it will. The Commission, ENISA, the BSI and the RDI all continue to state the date, and the Digital Omnibus, which proposes a single entry point for reporting under NIS2, GDPR, DORA, CER and eIDAS and is explicitly built on ENISA's experience with the CRA platform, proposes no amendment to the CRA and no postponement. The honest residual risk: as at 31 July 2026 ENISA described the platform as not yet live, scheduled to be operational by 11 September, and has published no contingency statement for non-readiness. Manufacturers can already create EU Login accounts; CSIRT-coordinator validation happens after first platform access.