Skip to the page
Eurus
Try it live
Menu

Cyber Resilience Act

Cyber Resilience Act, in plain words.

The EU law that makes software and connected devices secure by design, kept patched, and open about their vulnerabilities. Regulation (EU) 2024/2847. In force since 10 December 2024. Reporting applies from 11 September 2026, and the rest from 11 December 2027.

Try it live Book an audit

Compliance, kept on every record

Who it covers

Manufacturers, importers and distributors of products with digital elements sold in the EU: software sold as a product, apps, connected devices and their components. Online services on their own are NIS2's.

What it asks

  1. Secure by design

    Ship the product with no known exploitable vulnerabilities and secure by default (Annex I, Part I).

  2. Vulnerabilities handled

    Handle vulnerabilities, with a software bill of materials, and provide security updates for the support period, normally at least five years (Annex I, Part II, and Article 13).

  3. Report in 24 and 72 hours

    An actively exploited vulnerability or a severe incident: an early warning within 24 hours and a notification within 72, through the single reporting platform to the CSIRT and ENISA (Article 14).

  4. Documentation and CE marking

    Conformity assessment and CE marking (Articles 28 to 32), with the technical documentation kept for ten years.

Try this in a copy of your own, for two hours, with nothing to sign up for.

Open your own copy

Also in the law

  1. Final reports

    Within 14 days of a fix for a vulnerability, or one month for an incident (Article 14).

  2. Fines

    Up to €15 million or 2.5 per cent of worldwide annual turnover for breaching the essential requirements (Article 64).

  3. The official text

    Regulation (EU) 2024/2847 on EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/2847/oj

Want it on your own systems?

We start with an audit: how your operations really run, mapped to the controls you keep.

Book an audit Next: The laws by sector