CRA

Cyber-secure products under the CRA

The Cyber Resilience Act requires manufacturers of products with digital elements to build in security by design and actively report vulnerabilities.

When the CRA applies to your product

The CRA entered into force in December 2024, with reporting obligations from September 2026 and most requirements from December 2027.

The regulation applies to almost any product with digital elements placed on the European market, from software to smart devices.

Your organisation develops or sells products with digital elements
There is no process yet for managing vulnerabilities over the product’s lifetime
It’s unclear which obligations apply to your specific products

Products that don’t meet the CRA may not be placed on the European market.

Actively exploited vulnerabilities that aren’t reported in time increase both the security risk and the enforcement risk.

The CRA requires security by design and by default, throughout the product’s lifetime, with an active reporting obligation for vulnerabilities.

A risk assessment of the product with digital elements
Security updates for a defined support period
Reporting actively exploited vulnerabilities and severe incidents within 24 hours
Technical documentation and CE marking
Due diligence requirements for importers and distributors

Vedeum helps determine which obligations apply to your products and how to embed this in your development process.

Applicability
We determine which products fall under the CRA and which obligations apply.
Risk assessment
We map vulnerabilities and risks of the product.
Implementation
We help set up a process for updates and vulnerability reporting.
Documentation
We support technical documentation and CE marking.

Tell us where your organisation stands. We will think through the first steps with you.