CRA — Cyber Resilience Act: Manufacturer Obligations (CE)

The CRA covers products with digital elements placed on the EU market — both hardware (such as IoT devices, routers) and software — whose function includes a direct or indirect connection to a network or device. The regulation divides products into default, important (class I and II), and critical, with increasing conformity assessment requirements. In the training we determine which category your organization's products fall into.

Regulation (EU) 2024/2847 has entered into force, but its obligations apply in stages: the obligation to report actively exploited vulnerabilities and severe incidents starts earlier, while the main manufacturer obligations (security by design, documentation, CE marking) apply from December 2027. In the training we cover this timeline and show how to use the time to prepare.

The CRA requires manufacturers to report an actively exploited vulnerability (one already being used in attacks) within 24 hours of discovering it — an early warning to the relevant CSIRT and ENISA, followed by more detailed reports later. In the workshop we build a vulnerability-handling process capable of meeting this deadline.

No — for default products, the CRA allows self-assessment of conformity by the manufacturer, whereas for important class II and critical products, involvement of a notified body or use of appropriate certification schemes is required. In the training we help classify the product and select the right conformity assessment path.

An existing application security programme (SAST/DAST/SCA, vulnerability management) provides a solid foundation for CRA requirements, but the CRA goes further — adding formal obligations for technical documentation, conformity assessment, and CE marking, plus a hard vulnerability reporting deadline. In the training we show how to map an existing programme onto CRA requirements and fill the missing pieces.