# Make your products CRA-compliant, without slowing development.

> The EU Cyber Resilience Act (Regulation (EU) 2024/2847) requires manufacturers of products with digital elements to design them securely, handle vulnerabilities for the product’s support period and report actively exploited vulnerabilities. Reporting obligations apply from 11 September 2026; all other requirements apply from 11 December 2027. Zyberum provides CRA gap analyses, secure development lifecycle implementation, vulnerability handling processes and penetration testing.

Get CRA-ready: gap analysis, secure development lifecycle, vulnerability handling, SBOM and penetration testing for products with digital elements.

Source: https://zyberum.com/cyber-resilience-act

The Cyber Resilience Act sets mandatory cybersecurity requirements for every hardware and software product with digital elements sold in the EU. We help manufacturers close the gaps with consulting, testing and a secure development lifecycle that fits your teams.

## Key CRA dates

- 10 Dec 2024: **Entry into force** The CRA was published and entered into force. The transition period started.
- 11 Jun 2026: **Conformity assessment bodies** Rules for notified bodies apply, so third-party assessments can be prepared.
- 11 Sep 2026: **Reporting obligations** Actively exploited vulnerabilities and severe incidents must be reported to ENISA and the CSIRT within 24 hours (early warning).
- 11 Dec 2027: **Full application** All essential requirements apply. Products without CE marking under the CRA can no longer be placed on the EU market.

## Our services to support CRA compliance

### CRA gap analysis

We classify your products (default, important class I/II, critical), map them against Annex I and deliver a prioritised roadmap.

### Secure development lifecycle

Security requirements, threat modelling, secure coding and code review integrated into your existing development process.

### Penetration testing

Independent security testing of devices, firmware, apps and cloud interfaces to find and fix vulnerabilities before market launch.

### Vulnerability handling

Coordinated vulnerability disclosure, PSIRT processes and 24h/72h reporting workflows for ENISA.

### SBOM & documentation

Software bill of materials, technical documentation and EU declaration of conformity prepared for audits.

### Team enablement

Training for product owners and developers so CRA requirements become part of everyday engineering.

## Regulation know-how plus hands-on testing

Our team combines extensive experience in product security with a deep understanding of EU regulation. We have implemented similar frameworks in automotive (UN R155, ISO/SAE 21434) and industry (IEC 62443), and we test products ourselves instead of only writing policies.

The result: compliance work that engineers accept, evidence that holds up in an assessment, and fewer vulnerabilities in the field.

**Official source**

- Regulation (EU) 2024/2847 is available on EUR-Lex in all official EU languages.

## FAQ

**Which products fall under the Cyber Resilience Act?**

Almost all hardware and software products with digital elements that are placed on the EU market and can connect to a device or network: IoT devices, industrial controllers, routers, apps and desktop software. Some sectors with their own rules, such as medical devices, motor vehicles and aviation, are excluded.

**When do I have to comply with the CRA?**

Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026. All other requirements, including CE marking under the CRA, apply from 11 December 2027.

**What are the penalties for non-compliance?**

Up to €15 million or 2.5% of worldwide annual turnover, whichever is higher, for violations of the essential requirements. Market surveillance authorities can also order non-compliant products to be withdrawn.

**Do I need a third-party assessment?**

Most products can be self-assessed. Important products of class II and critical products need a notified body or a certification scheme, and class I products need one if harmonised standards are not fully applied.

---
Zyberum GmbH. Canonical page: https://zyberum.com/cyber-resilience-act