Cybersecurity & Digital
Essential cybersecurity requirements in Annex I
Maximum vulnerability reporting window to ENISA
Maximum penalty for non-compliance (or 2.5% global turnover)
Regulation Overview
The EU Cyber Resilience Act is the first horizontal regulation imposing mandatory cybersecurity requirements on all products with digital elements sold in the EU. For supply chain and compliance teams, this means collecting, validating, and maintaining cybersecurity evidence across every component, supplier, and software dependency in your product portfolio.
The CRA requires manufacturers to meet 21 essential cybersecurity requirements covering secure-by-design development, vulnerability handling, and lifecycle support. Products must carry CE marking to prove CRA conformity. Manufacturers must maintain SBOMs, report actively exploited vulnerabilities to ENISA within 24 hours, and retain technical documentation for 10 years.
CRA compliance requires component-level cybersecurity evidence from every supplier in your chain. Third-party components cannot compromise product security—and the manufacturer bears responsibility for proving it.
Key Components / Sub-Frameworks
Manufacturers of hardware and software products with digital elements sold in the EU
Importers placing products with digital elements on the EU market
Distributors making products with digital elements available in the EU
Non-EU companies selling through EU importers or authorized representatives
Companies integrating third-party components into products with digital elements
Open-source stewards commercially distributing software in the EU market
Key Thresholds
You need a machine-readable SBOM for every product. Your product contains 200 components from 40 suppliers. Twelve suppliers provide no software documentation. Eight provide outdated BOMs. The rest use incompatible formats. You have no unified view of what's actually in your products—let alone their vulnerability status.
A critical vulnerability is discovered in a third-party library embedded three tiers deep in your product. ENISA requires notification within 24 hours. You don't know which products are affected, which suppliers provided the component, or whether a patch exists. The clock is already running.
Important Class II products require third-party conformity assessment. The notified body requests your technical documentation—risk assessments, SBOM, test reports, supplier security attestations. Your evidence is scattered across email threads, SharePoint folders, and supplier portals. Compiling the file takes weeks.
The CRA holds manufacturers responsible for third-party component security. Your supplier's component fails a cybersecurity requirement—your product loses CE marking eligibility. Without systematic supplier cybersecurity declarations and component-level tracking, you cannot prove due diligence.
Certivo In Action
CRA Workflow
Electronics Manufacturing
Pain Point
Massive product portfolios with embedded software; Default + Important classification
Industrial & Heavy Equipment
Pain Point
Legacy OT components; IEC 62443 overlap; long product lifecycles
Automotive Manufacturing
Pain Point
UN R155/CRA overlap; complex ECU supply chains; OEM flowdown
Aerospace & Defense
Pain Point
Stringent documentation; prime flowdown to sub-tier software suppliers
Medical Devices & Equipment
Pain Point
EU MDR/IVDR intersection; Class II/III software-driven devices
Semiconductor & High-Tech
Pain Point
SaaS exclusions but on-premise/embedded products in scope; rapid release cycles
Consumer Goods
Pain Point
RoHS/CRA overlap for smart products; CE marking dependency
Cybersecurity Products
Pain Point
Important Class II by default; mandatory third-party assessment
From Manual Evidence Assembly to Automated Documentation
CORA-powered regulatory intelligence collects, parses, and validates supplier cybersecurity evidence automatically. Your team focuses on conformity decisions—not chasing SBOMs and compiling technical files.
Conformity Documentation Acceleration
Generate complete, audit-ready CRA technical documentation packages in hours—not the months of manual compilation across suppliers and engineering teams.
Proactive CRA Compliance Assurance
When new CVEs are published, Certivo identifies affected products and components instantly. Know your exposure before ENISA reporting deadlines—not after.
Key Statistics
Frequently Asked Questions
What products are covered by the EU Cyber Resilience Act?
The CRA applies to all products with digital elements—hardware and software—that connect directly or indirectly to a device or network and are placed on the EU market. This includes IoT devices, embedded software, enterprise applications, industrial controls, and connected consumer products. Medical devices, vehicles, and aviation products covered by sector-specific regulations are excluded. Certivo helps manufacturers classify their product portfolios and identify which items fall within CRA scope.
What is the SBOM requirement under the CRA?
Manufacturers must create and maintain a machine-readable Software Bill of Materials listing at minimum top-level dependencies for every product with digital elements. The SBOM must be included in technical documentation and provided to market surveillance authorities on request. CORA-enabled analysis collects supplier SBOMs in any format—CycloneDX, SPDX, PDF, or freeform—and normalizes them into a unified, audit-ready inventory.
What are the penalties for CRA non-compliance?
Non-compliance with essential cybersecurity requirements can result in fines up to €15 million or 2.5% of global annual turnover, whichever is higher. Other violations carry fines up to €10 million or 2% of turnover. Providing false information to authorities can trigger fines up to €5 million or 1% of turnover. Authorities can also require product recalls and block market access.
How does Certivo help with CRA conformity assessments?
Certivo collects and validates the supplier-side evidence required for CRA conformity assessments—cybersecurity declarations, component SBOMs, vulnerability disclosures, and security update commitments. CORA-driven compliance intelligence maps collected evidence against the 21 essential requirements and generates pre-structured technical documentation packages aligned with Annex VII. This reduces conformity preparation from months to hours.
How does CRA relate to NIS2 and other EU cybersecurity regulations?
CRA addresses product-level cybersecurity. NIS2 addresses organizational cybersecurity for essential and important entities. Many companies must comply with both. The CRA also intersects with the Radio Equipment Directive (RED) for wireless products and sector-specific rules like UN R155 for automotive. Certivo validates supplier evidence against multiple cybersecurity frameworks simultaneously, eliminating duplicate collection campaigns.