Cyber Resilience Act

The Cyber Resilience Act (CRA) is an EU regulation that sets mandatory cybersecurity requirements for hardware and software products with digital elements offered in the EU. It requires products to be secure by design and by default, remain resilient against threats throughout their lifecycle, and provide users with the information they need.

Key facts

  • What it is: Regulation (EU) 2024/2847, a harmonized EU cybersecurity framework for products with digital elements.
  • Entered into force: 10 December 2024.
  • Who it applies to: Manufacturers, importers, and distributors of in-scope products made available on the EU market in the course of a commercial activity. Open-source software stewards have limited obligations.
  • Key dates: Vulnerability and incident reporting obligations apply from 11 September 2026. The substantive requirements apply from 11 December 2027.
  • What it protects against: Cyber threats and vulnerabilities in connected hardware and software across the product’s entire lifecycle, including those introduced through third-party components.

How the Cyber Resilience Act Works

The CRA’s obligations fall into two broad categories: security requirements for the product itself, and ongoing obligations throughout its lifecycle.

Product-level requirements. Cybersecurity must be built into product design and development, including:

Lifecycle requirements. Manufacturers must:

  • Maintain visibility of the software components and dependencies within their products, including through a software bill of materials (SBOM).
  • Operate a formal vulnerability-management process.
  • Publish a vulnerability disclosure policy.
  • Address vulnerabilities throughout the product’s support period, with patches and security updates provided without undue delay.

Reporting obligations. Manufacturers must notify the relevant authorities of actively exploited vulnerabilities and severe incidents within set timeframes, starting with an early warning within 24 hours of becoming aware of the issue.

Key dates

  • 10 December 2024: The CRA enters into force.
  • 11 September 2026: Vulnerability and incident reporting obligations apply.
  • 11 December 2027: The substantive requirements apply.

Manufacturers of in-scope products should already have vulnerability-management and incident-reporting processes in place ahead of the 2027 deadline.

Who the Cyber Resilience Act Applies To

A product with digital elements is broadly defined as any hardware or software product, including certain associated remote data-processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. The definition captures everything from IoT devices and embedded software to standalone software and connected applications. Obligations vary by role.

Manufacturers

Carry the heaviest obligations: secure design, vulnerability handling, security updates, documentation, and reporting. A company that commercially develops, supplies, or substantially modifies open-source software may, depending on its role, be treated as a manufacturer.

Importers

Must ensure that products they bring into the EU market comply with the CRA before sale or distribution.

Distributors

Must act with due care and verify that the products they make available meet the Act’s requirements.

Open-Source Software Stewards

Free and open-source software supplied outside a commercial activity is generally excluded. Stewards of such software are subject to certain limited obligations.

The CRA is often confused with other cybersecurity and data regimes. The main difference is what each one regulates.

Cyber Resilience ActNIS2 DirectiveGDPRPCI DSS
RegulatesProducts with digital elementsEntities in critical and important sectorsProcessing of personal dataHandling of payment card data
Applies toManufacturers, importers, distributorsEssential and important entitiesControllers and processorsOrganizations that store, process, or transmit card data
NatureEU regulationEU directive (transposed by member states)EU regulationIndustry standard
Core question“Is the product secure throughout its lifecycle?”“Is the organization managing cyber risk?”“Is personal data lawfully protected?”“Is cardholder data protected?”

The CRA complements these regimes rather than replacing them. A company can fall under several at once, for example as a software vendor (CRA), an operator in a regulated sector (NIS2), and a processor of customer data (GDPR).

Why the Cyber Resilience Act Matters

  • Legal exposure: Non-compliance can lead to significant penalties. The CRA provides for fines of up to €15 million or 2.5% of worldwide annual turnover for failing to meet the essential cybersecurity requirements
  • Obligations are already live: Reporting duties have applied since 11 September 2026, so reporting readiness cannot wait for the 2027 deadline.
  • Supply-chain accountability: The CRA’s focus on software security extends beyond in-house code. Third-party libraries, services, and scripts can introduce vulnerabilities or be compromised, and supply-chain attacks involving JavaScript packages show how a compromised component can affect downstream apps and websites.
  • The client-side angle: Manufacturers need visibility into the components and dependencies that make up their products, and measures to protect software integrity and address vulnerabilities across the lifecycle. For web applications, this can include monitoring third-party scripts delivered to users’ browsers and detecting unauthorized changes to client-side code.

Client-side integrity monitoring is not a specific CRA requirement. It is a practical measure that supports the regulation’s broader goals around software integrity, vulnerability management, and supply-chain security.

Best Practices for Cyber Resilience Act Readiness

  • Determine your role and scope. Work out whether your products are in scope and whether you act as a manufacturer, importer, or distributor. Include open-source components you commercially supply or substantially modify.
  • Build a component inventory. Maintain a current record of the software components and dependencies in each product, including third-party libraries and scripts.
  • Operate a vulnerability-management process. Track, triage, and fix vulnerabilities throughout the support period, and deliver security updates without undue delay.
  • Publish a vulnerability disclosure policy. Give researchers and users a clear way to report issues.
  • Prepare for reporting. Define who decides what counts as an exploited vulnerability or severe incident, and rehearse the 24-hour early warning.
  • Adopt secure by design and default. Apply secure default configurations, access controls, data and communication protection, and software integrity safeguards from the start.
  • Monitor all client-side code. Track all first- and third-party scripts delivered to users’ browsers, and detect unauthorized changes.
  • Document everything. Keep evidence of your processes and decisions so you can demonstrate compliance to authorities.

Solutions by Jscrambler

Jscrambler’s Unified Client-Side Security Platform supports a broader CRA compliance strategy by giving teams visibility into the scripts and third-party code running in the browser. It inventories scripts on your pages and detects unauthorized changes, supporting software integrity and supply-chain security goals. It does not by itself make a product CRA-compliant. 

Frequently Asked Questions

What is the Cyber Resilience Act?
The CRA is an EU regulation that sets mandatory cybersecurity requirements for hardware and software products with digital elements offered in the EU. It covers secure design, lifecycle vulnerability handling, and incident reporting.

When does the Cyber Resilience Act apply?
The regulation entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the substantive requirements apply from 11 December 2027.

Who must comply with the Cyber Resilience Act?
Manufacturers, importers, and distributors of products with digital elements made available on the EU market in the course of a commercial activity. Open-source software stewards have limited obligations.

Does the Cyber Resilience Act apply to open-source software?
Free and open-source software supplied outside a commercial activity is generally excluded. A company that commercially develops, supplies, or substantially modifies open-source software may be treated as a manufacturer, depending on its role.

What are the CRA’s reporting requirements?
Manufacturers must notify the relevant authorities of actively exploited vulnerabilities and severe incidents within set timeframes, starting with an early warning within 24 hours of becoming aware.

Does the Cyber Resilience Act require client-side script monitoring?
No, not specifically. However, monitoring the scripts and third-party code delivered to users’ browsers can support the CRA’s broader requirements around software integrity, vulnerability management, and supply-chain security.

Does the CRA apply to websites and web applications?
It depends. The CRA covers software products and certain associated remote data-processing solutions. Whether a given web application is in scope depends on how it is delivered and its relationship to a product, so confirm with legal counsel.

Related Resources

Glossary

DAST

With the evolution of software applications and the sophistication of cyber threats, security testing is now an integral and necessary part of software development cycles. Dynamic Application Security Testing, often referred to as DAST, is one of the strongest weapons in a security team's arsenal.

Read More_ Glossary

Data Classification

Not all data is created equal. In today’s nuanced digital business environment, trying to protect every single data asset in the same way is impractical, inefficient, and inadvisable. Without appropriate levels of protection tailored to the sensitivity and importance of each type of data, cybersecurity and compliance risks increase, costs spiral, and efficiency deteriorates. To safeguard against these unwanted outcomes, organizations must apply appropriate security, compliance, and operational measures through a process known as data classification.

Read More_ Glossary

Data Exfiltration

Data exfiltration is the unauthorized movement of sensitive or confidential information from within an organization's network to an external location, often controlled by attackers or malicious actors. Data exfiltration is a critical threat for organizations and an urgent concern in cybersecurity. This attack can occur through internal and external threats: Internal threats: users inside your organization who use their authorized access, intentionally or unintentionally, to compromise your organization's network, data, or devices.An authorized employee with access to the company system; External threats: risks from outside the network that gain access and go beyond the organization's security perimeter.

Read More_