Regulation (EU) 2024/2847 of the European Parliament and of the Council, better known as the Cyber Resilience Act (CRA), is a framework regulation of the European Union introducing horizontal, mandatory cybersecurity requirements for products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect connection to a network or another device.
The Regulation was published in the Official Journal of the European Union on 20 November 2024 and enters into force on the twentieth day following its publication. Its main provisions will apply from 11 December 2027, with certain earlier obligations taking effect in 2026.
This act forms part of the EU’s broader strategic cybersecurity package and was adopted in response to the growing cyber threats in the digital economy — from connected consumer devices to critical infrastructure systems.
 
Why the Regulation Is Necessary
Existing EU legislation, including the Directive on Security of Network and Information Systems (NIS) and the Cybersecurity Act (Regulation on cybersecurity certification), establishes a framework for network services and systems. However, these instruments do not explicitly cover products with digital elements — hardware and software — whether intended for consumers or businesses.
Regulation (EU) 2024/2847 fills this gap by requiring cybersecurity “by design” and throughout the entire lifecycle of the product.
 
Scope of the Regulation
The Regulation applies to “products with digital elements,” defined as hardware and software products whose intended and reasonably foreseeable use includes a direct or indirect connection to a network or another device.
This includes:

• IoT devices (e.g., “smart” home products)
• Software products placed on the market as standalone products or as part of a hardware product whose intended or reasonably foreseeable use includes a direct or indirect network connection
• Industrial systems with digital interfaces

The Regulation adopts a horizontal approach and does not apply to products already covered by other EU legal acts containing specific cybersecurity requirements, provided those requirements ensure an equivalent level of protection.
 
Core Requirements and Principles
1. Security by Design and Security by Default
Manufacturers are required to integrate cybersecurity from the design phase — from architectural decisions to the definition of default configurations that ensure minimal exposure to risks. This concept includes vulnerability risk management, reduction of attack surfaces, and secure default settings.
2. Vulnerability Management and Product Lifecycle
The Regulation requires manufacturers to establish processes for identifying, analysing, and remedying vulnerabilities, as well as providing regular security updates throughout the supported lifetime of the product.
Manufacturers are obliged to notify competent authorities and ENISA of actively exploited vulnerabilities and serious incidents having significant impact within the deadlines set out in the Regulation.
3. Documentation and Transparency
Manufacturers must maintain technical documentation, including information on components, identified risks, and mitigation measures, as well as details regarding support mechanisms and security updates. This increases transparency and facilitates conformity assessment.
4. Conformity Assessment and CE Marking
Products with digital elements falling within the scope of the Regulation must undergo a conformity assessment procedure. Successful assessment allows the product to bear the CE marking, demonstrating compliance with the cybersecurity requirements.
 
Timeline for Application
The main framework of Regulation (EU) 2024/2847 will apply from 11 December 2027. Certain specific requirements — particularly those concerning vulnerability and incident reporting — will apply earlier, from 11 September 2026, while some provisions begin to apply from 11 June 2026.
 
Exemptions and Special Cases
The Regulation does not apply to products already governed by other EU legal acts containing specific cybersecurity requirements, where those requirements provide an equivalent level of protection.
Open-source software developed or supplied outside the course of a commercial activity and not placed on the market as a product generally falls outside the scope of the Regulation. However, where open-source software is integrated into a commercial product or supplied in the course of a commercial activity, the Regulation may become applicable.
 
Impact on Businesses
The Regulation requires structural changes in the way products are developed and placed on the market. For manufacturers, this means:

• Reassessment of product portfolios and architectures
• Integration of vulnerability and lifecycle management
• Development of internal compliance, documentation, and audit processes
• Establishment of cybersecurity teams and staff training

Non-compliance may result in significant administrative penalties, including fines linked to percentages of annual global turnover or fixed maximum thresholds, depending on the type of infringement.
 
Regulation (EU) 2024/2847 represents a significant step forward in the legal regulation of cybersecurity in the European Union, establishing uniform minimum security requirements for digital products across the single market.
It reflects the EU’s commitment to protecting consumers and businesses from cyber risks throughout the digital economy — from connected devices to complex software systems.