In force for over a year, the European regulation on the security of digital products has so far stayed in the background. But with the first reporting obligations arriving in September 2026 and full application set for December 2027, the time to prepare is running out fast.
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, has been in force since 10 December 2024, yet many companies — manufacturers and users alike — have so far treated it as a distant obligation. That is understandable, given that attention has meanwhile focused on the more immediate NIS2 deadlines and on the GDPR obligations already in operation. Now, however, the CRA timeline is becoming concrete: the first notification obligations kick in in September 2026, and anyone who makes or distributes products with digital elements — from business management software to routers, from industrial IoT devices to machinery firmware — can no longer afford to postpone.
Why a regulation on products
Until now, European cybersecurity legislation has focused mainly on organizations: the GDPR requires technical and organizational measures from those who process personal data, and the NIS2 Directive obliges essential and important entities to adopt cyber risk management policies. But no rule systematically addressed the problem upstream, namely the security of the products those organizations buy and use every day.
The CRA fills this gap. The underlying idea is simple: if a company is required to protect its networks and the data it processes (as NIS2 and the GDPR demand), it must be able to rely on products that are secure by design and by default. Responsibility for security cannot fall solely on the end user; it must start with the manufacturer.
Who it applies to
The regulation addresses manufacturers, importers and distributors of products with digital elements, meaning any hardware or software whose intended use includes a direct or indirect connection to a device or network. The scope is vast: IP cameras, smart TVs, routers, operating systems, desktop and mobile applications, industrial software, embedded components.
Products already covered by specific sectoral legislation that guarantees an equivalent level of protection are excluded, such as medical devices (regulated by the MDR), motor vehicles and aviation systems. Open-source software developed outside a commercial activity is also generally excluded, but beware: if FOSS is integrated into a commercial product or monetized, it falls within the scope of the CRA.
SMEs are not exempt, but the regulation provides facilitation measures to reduce the compliance burden.
The main obligations
The core of the CRA lies in the essential cybersecurity requirements of Annex I, which manufacturers must meet throughout the product's entire life cycle — from design to decommissioning. The most relevant aspects include risk assessment, minimization of the attack surface, protection of the integrity and confidentiality of the data processed by the product, secure update management and complete technical documentation, including the generation of an SBOM (Software Bill of Materials).
Manufacturers must also implement a structured vulnerability management process for the entire declared support period, and provide free security updates for at least five years from placing the product on the market.
A particularly impactful obligation is notification: from 11 September 2026, manufacturers will have to report any actively exploited vulnerability to the national CSIRT and to ENISA within 24 hours of discovery, with an initial assessment within 72 hours and a final report within 14 days of a fix becoming available.
The deadlines
The application timeline is structured in three phases. In June 2026, the rules on the notification of conformity assessment bodies come into operation. From September 2026, the obligations to report actively exploited vulnerabilities and severe incidents apply. Full application of the regulation is set for 11 December 2027: from that moment, no product with digital elements may be placed on the EU market without the CE marking attesting conformity with the CRA.
The transition period may seem long, but for a company that has to rethink its development processes, train its teams, produce technical documentation and — where necessary — undergo third-party conformity assessment by notified bodies, time is anything but abundant.
The relationship with NIS2, GDPR and ISO 27001
The CRA does not operate in isolation: it fits into a regulatory ecosystem that is progressively converging. Understanding the relationships between these rules is essential to building an integrated compliance strategy.
NIS2 imposes cybersecurity obligations on organizations classified as essential or important entities (in Italy, the deadline for adopting security measures is October 2026). The CRA acts upstream, ensuring that the products used by those entities have a minimum level of security. The two rules complement each other: a NIS2 entity that uses CRA-compliant products will have a significant advantage in demonstrating the adequacy of its technical measures. Likewise, the supply chain — a central theme of NIS2 — benefits directly from a market in which digital products must meet minimum security standards.
The GDPR comes into play whenever the product with digital elements processes personal data, and such situations are more frequent than one might think: an IoT device that collects environmental data in an office, an application that manages credentials, firmware that records access logs. The principle of data protection by design (Art. 25 GDPR) and the obligation to adopt appropriate technical measures (Art. 32 GDPR) find a natural ally in the CRA. A CRA-compliant product, which guarantees the integrity, confidentiality and availability of the data processed, contributes directly to the GDPR compliance of the organization that uses it. And in the event of a data breach originating from a product vulnerability, the manufacturer's CRA compliance will become a relevant factor in assessing liability.
Finally, ISO/IEC 27001 — the international standard for information security management systems — offers an operational framework that can support both NIS2 and CRA compliance. An ISO 27001-certified organization that integrates into its controls the verification of the security of purchased products and the management of product vulnerabilities will have a solid basis for meeting the requirements of several regulations at once.
What to do now
For manufacturers of digital products — software houses, makers of connected hardware, developers of firmware and embedded components — the compliance path should start immediately, with a mapping of the products in scope, a gap analysis against the essential requirements of Annex I and the definition of a vulnerability management process compliant with the regulation.
For user organizations — and in particular those subject to NIS2 and the GDPR — the CRA is both an opportunity and a new benchmark: the security of the digital products they purchase will no longer be just good practice, but a regulatory requirement. Now is the time to include CRA compliance criteria in procurement processes and supplier assessments.
Argo Business Solutions assists organizations in defining integrated compliance strategies across the CRA, NIS2 and the GDPR with a multidisciplinary approach that combines legal, technical and organizational expertise. For more information: argobs.com/en/contact-us