EU Cyber Resilience Act: A Complete Preparation Guide for Manufacturers for 2026

What Is the Cyber Resilience Act?

The Cyber Resilience Act (Regulation (EU) 2024/2847, hereafter CRA) is the EU's first horizontal cybersecurity regulation for products with digital elements. It entered into force on 10 December 2024 and establishes mandatory cybersecurity requirements for the design, development, production, and ongoing maintenance of any connected product placed on the EU market.

The CRA imposes three categories of obligation on manufacturers:

These three categories do not all apply at the same time, which is where most of the industry confusion originates.

The Two Deadlines

The CRA's obligations apply in two distinct phases, and understanding the difference between them is the single most important thing a manufacturer can do before spending a cent on compliance.

Which Products Are in Scope?

A product is in scope when three conditions are met simultaneously: it meets the definition of a product with digital elements, it is made available on the EU market, and its intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.

Products manufactured exclusively for one's own use are not covered. Several categories are fully or partially exempted: medical devices (EU) 2017/745, in vitro diagnostic medical devices (EU) 2017/746, motor vehicles (EU) 2019/2144, civil aviation products certified under (EU) 2018/1139, and marine equipment under Directive 2014/90/EU.

Product Categories: Default, Important, and Critical

The CRA divides products into three tiers. The tier determines the conformity assessment procedure required before the CE marking can be affixed — specifically, how much independent third-party involvement is required.

Classification is determined by the core functionality of the product — not its name, marketing description, or ancillary features. Both Annex III and Annex IV are technically described in Commission Implementing Regulation (EU) 2025/2392 .

How many CRA projects will you need?

This question is critically important — it is one of the primary drivers of your total CRA compliance cost. Manufacturers commonly have more than 100 products. Running a separate compliance project for each is neither feasible nor necessary. Where products share sufficient characteristics, they can be grouped into product families.

The rule of thumb for forming a product family is to assess similarity across five dimensions:

• Product context — Similar intended purpose and reasonably foreseeable use, product functions, operational environment, and user types
• Assets — Similar things of value — security parameters (e.g., cryptographic keys), network functions, software components — that if compromised could affect the product security, its users or the manufacturer.
• Security mechanisms — Similar authentication, access control, secure storage, communication, and update mechanisms
• Architecture — Similar system architecture and hardware components
• Operating system — Running on the same OS or firmware base

The Standards That Operationalise the CRA

The CRA defines essential requirements — the cybersecurity outcomes products and manufacturers must achieve. However, these requirements are deliberately high-level and technology-neutral: they define what must be achieved, not how. Standards bridge that gap. They translate each essential requirement into concrete, testable activities and controls, making it possible to demonstrate that a product or process actually meets what the regulation demands.

Horizontal standards — applicable to all products

Three horizontal standards form the baseline for every manufacturer regardless of product category.

Vertical standards — applicable to important and critical products

Important and critical products must comply with their product-category-specific vertical standard. For some categories, two vertical standards are in development: an EN 304 6XX for non-industrial products and an EN 62443-5-XX security profile for industrial products. These do not apply simultaneously — manufacturers determine which applies based on the intended purpose and reasonably foreseeable use of their product.

The table below shows the current state of all vertical standards. Where no draft is yet available, manufacturers should prepare using the horizontal standards and be ready to incorporate vertical requirements as soon as drafts become available.

Scroll horizontally to see all columns on small screens.

What Article 14 Requires and What Triggers a Report

Article 14 is not a general vulnerability management obligation. It is an event-triggered reporting duty that applies only when a manufacturer becomes aware of one of two specific events.

The Reporting Process

Once a reportable event occurs, manufacturers must follow a structured multi-step notification process. Steps can be collapsed if earlier submissions already contained the required information.

For an actively exploited vulnerability

For a severe incident

Reports go simultaneously to the CSIRT designated as coordinator and to ENISA, both via a single submission on the CRA Single Reporting Platform (SRP), expected to be operational by 11 September 2026. Manufacturers must also notify impacted users directly. If a manufacturer fails to do this in a timely manner, the CSIRT designated as coordinator may step in.

Identifying Your CSIRT

Determining which CSIRT to notify is not always straightforward, particularly for non-EU manufacturers. The determination follows a decision logic based on your establishment in the Union. We have produced a dedicated Q&A to help manufacturers work through this step — you can find it on our CRA Article 14 reporting obligations page.

A map of all EU Member State CSIRTs is available at csirtsnetwork.eu .

What to Actually Prepare Before September 2026

There is very little to prepare upfront for this deadline. The information required in reports can only be gathered after an event occurs — you cannot pre-fill a vulnerability report before discovering a vulnerability. The two things worth doing now:

• Know which CSIRT you would notify — Use the flowchart referenced above to determine your main EU establishment and identify the corresponding CSIRT.
• Know where your products are sold — Reports require you to list the EU Member States where the affected product is available.

That is genuinely it for September 2026. The energy you save here is better spent on what comes next.

Plan Your CRA Projects

The first task before any technical or process work begins is to determine how many compliance projects you will need to run. As discussed above, grouping products into families wherever possible is the single highest-leverage cost reduction available to you at this stage. The criteria for forming a product family — similar context, assets, security mechanisms, architecture, and operating system — should be assessed systematically across your full product portfolio before committing to a project structure.

Conduct a Risk Assessment

Before you can implement product security controls, you need to understand what risks your product faces. The standard governing this is prEN 40000-1-2, which defines the generic cybersecurity principles and risk management framework for all products with digital elements.

The risk assessment process follows a structured six-stage sequence:

The critical output of the risk assessment is the identification of which CRA essential requirements apply to your product and how they are implemented. This is what the technical documentation must capture and what market surveillance authorities will examine.

Run a CRA Gap Analysis

Once you have a picture of your risk profile, the next step is to assess where you currently stand against all CRA obligations. A proper CRA gap analysis covers all three compliance pillars: product security (mapped against EN 18031 and prEN 40000-1-4, plus the applicable vertical standard for important and critical products), vulnerability handling processes (mapped against prEN 40000-1-3), and user documentation (mapped against Annex II).

The output is a requirement-level picture of what is already met, what has gaps, and what needs to be built before December 2027.

The Three Compliance Pillars

Pillar 1: Product Security

With your risk assessment complete and your gap analysis in hand, you implement the product security controls required by your applicable standard — prEN 40000-1-4 for default products, the relevant vertical standard (from the table above) for important and critical products. Not every essential requirement applies to every product, but where a requirement does not apply, that determination must be justified and documented in your technical documentation.

Pillar 2: Vulnerability Handling (prEN 40000-1-3)

This applies to every manufacturer regardless of product category. The standard structures vulnerability handling into six phases with 59 mandatory requirements, 29 of which fall in the Preparation phase alone. The stakeholders involved span CISO, PSIRT, Product Management, Legal, Customer Support, and PR.

Manufacturers must produce seven documents:

Pillar 3: Information and Instructions to Users (Annex II)

CRA Annex II lists 14 specific documentation obligations covering what manufacturers must communicate to users — from security configuration guidance and known cybersecurity risks, to end-of-support timelines and instructions for secure decommissioning. These are mandatory under Article 13 and for most organisations represent deliverables that do not yet exist in any structured form.

Conformity Assessment and CE Marking

Once compliance is achieved, manufacturers must demonstrate it through a formal conformity assessment and affix the CE marking. Three procedures are available:

Once harmonised standards are formally adopted and their references published in the Official Journal of the EU, manufacturers who correctly apply those standards benefit from a presumption of conformity for the requirements they cover.

A Practical Compliance Roadmap

• Right now: Classify products, determine project count, identify CSIRT, identify applicable standards, begin risk assessments, run CRA gap analysis.
• By September 2026: Register on the SRP, report actively exploited vulnerabilities or severe incidents if they occur.
• Between now and December 2027: Draft Vulnerability Handling Policy, publish CVD Policy, build SBOM and hardware component list, establish Security Test and Review Plan, implement product security controls, prepare Annex II documentation, incorporate vertical standards as available, complete conformity assessment.

The manufacturers who start now — with classified products, a structured risk assessment, and a clear gap analysis — will spend the next 18 months remediating in an orderly, prioritised way. Those who wait will face a compressed and expensive scramble as December 2027 approaches.

Frequently Asked Questions

Common questions about the Cyber Resilience Act (CRA), its deadlines, standards, and compliance requirements.