Cyber Resilience Act (CRA)

Implementing the Cyber Resilience Act – clarify scope, close gaps

The Cyber Resilience Act covers manufacturers, importers and distributors of products with digital elements – from software and IoT devices to machinery with a control system. The reporting obligation has applied since 11 September 2026; the regulation applies in full from 11 December 2027. We clarify with you whether you are affected and identify CRA gaps early.

Last updated:

Book a free intro callCall: +43 662 299055

In brief

Am I affected by the Cyber Resilience Act?

The Cyber Resilience Act (Regulation (EU) 2024/2847) applies to manufacturers, importers and distributors of products with digital elements made available on the EU market: software, connected devices and machinery with a control system. It applies directly in all member states – no Austrian implementing act is needed for that – and regardless of company size. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents; all remaining obligations apply from 11 December 2027. Whether your product is in scope depends on the type of product, its intended use and the exclusions.

The two deadlines of the Cyber Resilience Act

  • Already applies11.09.2026

    Reporting obligation for manufacturers

    Actively exploited vulnerabilities and severe incidents (Article 14).

  • Applies in full11.12.2027

    All remaining obligations

    Security requirements, documentation, conformity assessment, CE marking.

  • Early warning24 h

    After becoming aware

    First report via ENISA's Single Reporting Platform.

  • Notification72 h

    With initial details

    Nature of the incident or vulnerability and measures taken; a final report follows.

Dates according to Article 71 of Regulation (EU) 2024/2847.

For manufacturers, importers and distributors

Your obligations depend on your role. Anyone who markets a product under their own name or substantially modifies it is treated as a manufacturer.

Manufacturers

Develop and place on the market

Security from the design stage, risk assessment, technical documentation, vulnerability handling and security updates during the support period, conformity assessment – and, since 11 September 2026, the reporting obligation.

Importers

Import from third countries

Place only compliant products on the market: verify that the manufacturer has provided conformity assessment, documentation and CE marking, and inform the manufacturer of vulnerabilities.

Distributors

Make available on the market

Act with due care: check the CE marking and accompanying documents and do not make products with known defects available.

Our service

How we support your CRA implementation

Personal exchange instead of generic advice: we start with whether and how you are affected and work from there towards the gaps. Meetings in English are no problem.

  1. Check scope

    Is your product covered by the CRA? We clarify scope and exclusions, your role as manufacturer, importer or distributor and the product category.

  2. Analyse gaps

    Gap analysis: your current state against the requirements of the regulation. The result is a prioritised action plan up to 11 December 2027.

  3. Vulnerability and reporting process

    Receive, assess and fix vulnerabilities; a reporting process with responsibilities for the 24-hour and 72-hour deadlines.

  4. Test the product

    A technical security assessment of your product, for example a penetration test or vulnerability scan – with rated findings and recommendations.

We advise on implementation. The conformity assessment itself is carried out by the manufacturer or – depending on the product category – a notified body.

Details in German: Cyber Resilience Act · Penetration Testing

Frequently asked questions

Am I affected by the Cyber Resilience Act?
The regulation covers manufacturers, importers and distributors of products with digital elements made available on the EU market – hardware and software whose intended or foreseeable use includes a data connection to a device or network. Company size does not matter: micro and small enterprises are covered too. Products governed by their own EU rules are excluded, among them medical devices, motor vehicles, certified aviation products and marine equipment. Whether a specific product is in scope, and in which category, has to be checked case by case.
What do I have to report since September 2026, and where?
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities in their products and severe incidents affecting the security of the product under Article 14 of the regulation. This involves an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report – for vulnerabilities no later than 14 days after a fix is available, for incidents within one month of the 72-hour notification. Reports are submitted via ENISA's Single Reporting Platform; they go simultaneously to the CSIRT designated as coordinator in the member state of the main establishment and to ENISA. For Austria, ENISA lists CERT.at as coordinator. The reporting obligation also applies to products placed on the market before 11 December 2027.
What applies from December 2027?
From 11 December 2027 all remaining obligations apply. Manufacturers must then, among other things, meet the essential cybersecurity requirements in Annex I, maintain a risk assessment and technical documentation, handle vulnerabilities during the support period, carry out a conformity assessment and affix the CE marking. Importers and distributors may only make products available that meet these requirements and have verification duties of their own.
How does the Cyber Resilience Act relate to NIS2 and the Austrian NISG 2026?
The Cyber Resilience Act regulates products: it sets cybersecurity requirements for products with digital elements across their life cycle. NIS2 and the NISG 2026 regulate entities: they oblige medium-sized and large organisations in critical sectors to manage risk, register and report incidents in their own operations. A manufacturer can fall under both – with its products under the CRA, as a company under the NISG 2026. The reporting channels are separate.
What does it cost to get started, and how does the intro call work?
The intro call is free and without obligation and takes 30 minutes – on site or remotely, in English if you prefer. We discuss your products, your role as manufacturer, importer or distributor and the state of your preparation. Afterwards you know whether a closer scope check or gap analysis makes sense. We quote the effort for that before any costs arise.

As of 13.11.2026. This page is not legal advice; the text of Regulation (EU) 2024/2847 is authoritative. According to publicly available sources, Austria had not yet designated a market surveillance authority for the Cyber Resilience Act in November 2026.

Cyber Resilience Act: are you affected?

Find out in a free 30-minute intro call whether your products fall under the Cyber Resilience Act and where you stand – on site, remotely or by phone first.

Book intro call Contact +43 662 299055