Regulation
What is the Cyber Resilience Act (CRA)?
Also known as: CRA, EU Cyber Resilience Act, Regulation (EU) 2024/2847
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU, covering their whole lifecycle from design to end of support.
Manufacturers must design products to be secure, handle vulnerabilities for the support period, provide security updates, document the components of the product (including a software bill of materials) and carry out a conformity assessment before placing the product on the market with a CE marking.
The CRA entered into force on 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, and the main obligations from 11 December 2027.
How Clateway helps
- EU Cyber Resilience Act compliance – Prepare for the EU Cyber Resilience Act: product registry, SBOM quality checks, CSAF advisory matching, threat modelling, pen test and conformity evidence.
- Vulnerability management – Scan your systems and technologies for CVEs, prioritise with EPSS and CISA KEV, track SLAs, sync Dependabot alerts and watch SaaS vendor advisories in one place.