The Cyber Resilience Act feels like a flood of obligations, but laid out on a timeline it's a manageable plan. Regulation (EU) 2024/2847 has three key dates and a clear order of steps. This article is
"We built an app for a client — who is the manufacturer under the CRA now?" This question troubles every agency and freelancer. The answer has a clear core and grey edges. Let's work through both, so
The first to ask you about the CRA won't be a surveillance authority — it'll be your customer. Large firms and public procurers push security requirements down to suppliers through questionnaires and
When people say "comply with the Cyber Resilience Act", most small software companies picture mountains of paperwork. In fact one of the first and most useful things is very concrete and takes minutes
The Cyber Resilience Act (Regulation (EU) 2024/2847) has two dates, and most small software companies remember only half of each. The second one — 11 December 2027, full conformity and CE marking — is
"We already have GDPR, so we don't need the CRA" — this sentence comes up often, and it's wrong. The CRA, NIS2 and GDPR are three different laws, each aimed at something else, and they can easily appl
Many companies make nothing — they just resell or import someone else's software and devices. It's easy to assume "the CRA doesn't concern us". It's not so: importers and distributors have their own d
Open source and the Cyber Resilience Act is a topic where relief and surprise mix. The relief: the regulation doesn't turn every open-source developer into a manufacturer. The surprise: when you use o
There's confusion around the CRA's harmonised standards — and it helps to know why. In short: the standards meant to make your life easier aren't out yet. Let's explain what that means for a small com
"A CE mark on software you just download from a website?" Yes — and the Cyber Resilience Act says exactly how. Before placing a product on the market, the manufacturer draws up an EU declaration of co
The phrase "risk assessment" sounds like a weeks-long project, but for a small company it's a two-page document you write once and then just maintain. The Cyber Resilience Act requires it in Article 1
If you're in the default class (which is most vendors — more in the classes article), you declare CRA conformity yourself. It's called Module A (internal production control): no notified body, but ful
Not every product with digital elements is assessed with the same rigour. The Cyber Resilience Act sorts them into four levels by risk, and yours determines whether you assess conformity yourself or n
The reporting duty under Article 14 is the first thing from the Cyber Resilience Act that applies for real — from 11 September 2026, and it applies even to products you placed on the market long ago.
The last step of the vulnerability-handling process is the most visible one: an advisory — a public notice that you have fixed a security problem. The Cyber Resilience Act requires it in Annex I, Part
Once you have a reporting channel and security.txt, one thing is still missing: a policy that says what happens to a report. The Cyber Resilience Act requires it in Annex I, Part II as a coordinated v
Among the Cyber Resilience Act's obligations there is one that costs an hour of work and is done once and for all: a channel through which people can report a vulnerability to you. It is required by A
"How long do we actually have to support this?" is the question that, under the Cyber Resilience Act, sets your costs for years ahead. The answer is in Article 13 of Regulation (EU) 2024/2847, and it
When a new vulnerability appears, a small company doesn't need an academic lecture — it needs to know what to do and by when. Four acronyms serve that purpose. Each answers a different question, and t
An SBOM sounds like a big compliance task, but in practice it is one command and a few minutes. The Cyber Resilience Act requires it in Annex I, Part II, point 1 as part of the vulnerability-handling
Of all the scope questions, SaaS and the Cyber Resilience Act generate the most confusion. The short answer: a pure cloud service is mostly outside the scope of Regulation (EU) 2024/2847. The longer a
For a small company, "does the CRA apply to us?" is the first and most important question — until you answer it, there is no point worrying about documentation or reporting. Regulation (EU) 2024/2847