Cyber Resilience Act guides

Plain-English explanations of what the EU Cyber Resilience Act asks of manufacturers, with the relevant passages quoted from the regulation. General information, not legal advice.

• CRA Article 14: reporting actively exploited vulnerabilities within 24 hours

  What the Cyber Resilience Act requires when a vulnerability in your product is actively exploited: the 24-hour early warning, the 72-hour notification, the final report, who receives them and how to prepare.

• Does the Cyber Resilience Act apply to your product? Scope, classes and deadlines

  Which products the EU Cyber Resilience Act covers, what is excluded, how important and critical products are assessed, and the key dates: 11 June 2026, 11 September 2026 and 11 December 2027.

• CRA SBOM requirements: what the Cyber Resilience Act asks for

  The Cyber Resilience Act requires an SBOM covering at least top-level dependencies, in a machine-readable format. What that means, who sees it, which formats work, and how to produce one for apps and firmware.