What Is the EU Cyber Resilience Act? A UK Compliance Guide

The EU Cyber Resilience Act (CRA) sets mandatory cybersecurity requirements for products with digital elements sold into the EU, and it already applies to UK organisations that sell there. Adopted on 23 October 2024 and in force since 10 December 2024, Regulation (EU) 2024/2847 covers software, connected hardware and the remote services that support them, from enterprise platforms to smart home devices. Reporting duties under Article 14 are live now; the rest of the regulation applies in full from 11 December 2027. For the reporting mechanics specifically, see our CRA reporting requirements guide.

Most coverage treats this as an EU-only concern, which misreads how far the regulation reaches. The CRA applies to any organisation, anywhere, that places a product with digital elements on the EU market. A UK manufacturer selling into the EU carries the same duties as one based in Berlin or Paris – incorporation and headquarters don’t factor into it. The regulation asks one question: is a product with digital elements being placed on the EU market?

For UK compliance and risk teams, that distinction matters. The UK has no domestic equivalent to the CRA, so a compliance programme has to be built directly from the EU requirements themselves. This guide covers what the CRA is, who it binds, what it requires, and what it means for UK organisations selling into the EU.

The Cyber Resilience Act is the EU's first horizontal cybersecurity law for products: it cuts across every sector and product category rather than targeting one industry. Earlier EU cybersecurity legislation, such as the NIS2 Directive, regulates operators of essential services. The CRA regulates the products those services run on.

The problem it addresses is largely structural: for decades, manufacturers of connected products had no legal obligation to build security in from the start. Cybersecurity was often treated as an afterthought, patched in later if at all; devices and software shipped with known vulnerabilities, default passwords, and no mechanism for receiving security updates. The European Commission's 2022 proposal cited the scale of the problem: global cybercrime cost an estimated €5.5 trillion in 2021, according to the figures it was working from at the time.

The CRA changes that model. Security is mandatory at the design stage now: manufacturers have to build it in, document it, maintain it through the product's lifecycle, and report when things go wrong. The regulation covers the full value chain, not just manufacturers but importers and distributors too.

What Article 1 Covers

Article 1 sets out four things: rules for placing products with digital elements on the EU market, essential cybersecurity requirements for how they're designed and built, obligations on manufacturers to handle vulnerabilities for as long as a product stays in use, and the market surveillance and enforcement mechanics behind all of it. CE marking under the CRA signals that a product meets those requirements, and it's what keeps EU market access open – from 11 December 2027, only a product carrying it can lawfully be placed on the EU market.

The CRA applies to three categories of economic operators, each with distinct obligations.

UK organisations usually fall into the manufacturer category. If your company develops a product and makes it available to EU buyers under your own name or trademark, you're the manufacturer, and you carry the full set of duties.

Routing sales through an EU importer adds a second regulated party; the duties themselves stay with you. The EU importer has to verify that you, as manufacturer, have completed the conformity assessment, drawn up the technical documentation and affixed CE marking before they can lawfully place the product on the market. Skip that work, and your EU distribution channel stops.

Three Scenarios Where the CRA Binds a UK Organisation

1. Direct sale to EU customers: the UK company is the manufacturer and carries all obligations.
2. Sale via an EU subsidiary under the UK parent's brand: the EU entity is likely an importer with its own verification duties; the UK parent remains the manufacturer.
3. White-label or marketplace routes: if a distributor or marketplace takes a UK product across the EU border under any arrangement, CRA obligations attach at that point.

The only UK organisation outside the CRA is one with no EU sales and no EU distribution arrangements at all.

The CRA's scope turns on the concept of a “product with digital elements” (PDE): any software or hardware product, and its remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. In practice, that covers most modern technology. If it connects, it's generally in scope.

What Is Included

1. Enterprise and consumer software applications
2. Operating systems and embedded software
3. Mobile applications
4. Cloud-connected hardware (routers, smart devices, industrial controllers)
5. Security tools (VPNs, firewalls, identity management software, SIEM systems)
6. IoT devices (smart home products, wearables, connected industrial equipment)
7. Software components placed on the market separately

What Is Excluded

The CRA carves out categories where sectoral legislation already applies or the public interest justifies different treatment:

1. Medical devices and in vitro diagnostic devices (covered by EU MDR/IVDR)
2. Motor vehicles and civil aviation products
3. Marine equipment
4. Products developed or modified exclusively for national security or defence purposes
5. Free and open-source software developed and supplied outside a commercial activity, though a lighter regime applies to commercial open-source stewards

The exclusions are narrower than most organisations assume. A product sold commercially that happens to use open-source components remains in scope. If in doubt, the default position is that the product falls within it.

Products face different levels of scrutiny depending on their class. The CRA creates three product classes, each with a different conformity assessment route, and the class a product falls into determines how much independent verification is needed before CE marking can be applied.

Default Products

Most products with digital elements fall here. Manufacturers can self-assess conformity against the essential requirements in Annex I, draw up the technical documentation, affix CE marking, and issue an EU declaration of conformity. No third-party assessment is required.

Important Products: Class I and Class II (Annex III)

Annex III products are considered higher risk because of their function or how widely they're used. They face enhanced conformity assessment, which can involve a notified body.

Class I includes, among others: identity management and privileged access management (PAM) software, browsers and password managers, VPN products, network management and SIEM systems, operating systems, routers, modems and switches intended for internet connection, smart home security products such as door locks, cameras and alarms, and internet-connected toys.

Class II covers a narrower, higher-risk tier: hypervisors and container runtime systems, firewalls and intrusion detection or prevention systems, and tamper-resistant microprocessors and microcontrollers. (Full Annex III classification breakdown.)

Critical Products (Annex IV)

A small number of products are designated critical. These require mandatory third-party conformity assessment by a notified body and, where required, a European Cybersecurity Certificate at assurance level “substantial” or above. Current Annex IV categories include hardware devices with security boxes and smart meter gateways.

If your product appears in Annex III or IV, the conformity route is more demanding and the lead time for certification is longer. Identifying your product class is the first step in any CRA readiness programme; our CRA requirements guide covers the conformity assessment routes in more detail.

The CRA's substantive obligations fall into three areas: secure design and development, vulnerability handling, and documentation. All three sit in Annex I of the regulation and apply throughout the product's entire lifecycle.

Secure by Design (Annex I, Part I)

Manufacturers have to ensure products are designed, developed and produced with a level of cybersecurity appropriate to the risks. The specific requirements include:

1. No known exploitable vulnerabilities at the point of market placement
2. Secure by default configuration, including the ability to reset to original state
3. Protection of confidentiality through encryption of data at rest and in transit
4. Protection of data integrity against unauthorised manipulation
5. Minimal data collection: only data that's adequate, relevant and necessary for the intended purpose
6. Resilience against denial-of-service attacks
7. Appropriate access controls, including authentication and identity management
8. A minimum support period of five years (or the expected product lifetime if shorter), during which security updates must be provided free of charge

Vulnerability Handling (Annex I, Part II)

This is where the operational burden becomes concrete. Manufacturers must:

1. Identify and document vulnerabilities and components, including a software bill of materials (SBOM) in a machine-readable format covering at least the top-level dependencies
2. Remediate vulnerabilities without delay and provide security updates separately from functionality updates where technically feasible
3. Apply regular security testing and reviews throughout the support period
4. Publish information about fixed vulnerabilities, including severity and remediation guidance
5. Run a coordinated vulnerability disclosure policy and a contact address for reporting
6. Distribute security updates automatically where applicable, and always free of charge

Documentation and Conformity

Manufacturers have to maintain technical documentation showing compliance with the Annex I requirements, draw up an EU declaration of conformity, and affix CE marking. Under Article 13, that documentation and the declaration of conformity must stay available to market surveillance authorities for at least ten years after the product is placed on the market, or for as long as the support period runs if that's longer.

That documentation burden is substantial. For organisations without an existing product security programme, building the technical file from scratch – risk assessments, SBOM, test records, vulnerability handling procedures – represents a considerable compliance investment.

The CRA's reporting obligations under Article 14 are already in force. They applied from 11 September 2026, well ahead of the December 2027 compliance deadline, and this is the first point at which non-compliance carries operational consequences.

Manufacturers have to report to ENISA (the EU Agency for Cybersecurity) and the relevant national Computer Security Incident Response Team (CSIRT) in two scenarios.

Actively Exploited Vulnerabilities

When a manufacturer becomes aware that a vulnerability in its product is being actively exploited:

1. Within 24 hours: Early warning notification to ENISA and the relevant CSIRT
2. Within 72 hours: Detailed assessment of the vulnerability
3. Within 14 days: Final report once a corrective or mitigating measure is available

Severe Security Incidents

When a manufacturer becomes aware of a severe incident affecting the security of its product:

1. Within 24 hours: Early warning notification
2. Within 72 hours: Detailed incident report
3. Within one month: Final report after the 72-hour notification

These timelines apply to products already on the EU market, not just new releases; existing products get the same treatment as new ones, with no phase-in period. A UK manufacturer with a product already in EU distribution was subject to these reporting obligations from 11 September 2026, regardless of when the product first reached the market.

The 24-hour window is demanding to run in practice. Manufacturers need established processes to identify whether a vulnerability is being actively exploited, engage technical and legal teams, and submit a compliant notification before the clock runs out. For organisations without mature vulnerability management, that's a capability gap to close.

The CRA creates a compliance asymmetry UK organisations need to understand clearly: the EU now has a detailed, binding product cybersecurity regime that the UK has yet to match. That gap has direct commercial consequences.

No Domestic Equivalent to Benchmark Against

The UK's Cyber Security and Resilience Bill, introduced in November 2025, is still moving through Parliament; it reached Report stage in the House of Lords in September 2026, with Royal Assent still pending. It focuses on operators of essential services and their supply chains, leaving product cybersecurity outside its scope, so its obligations diverge sharply from the CRA's product-level requirements (our guide to the Bill covers its own scope and timelines). UK manufacturers selling into the EU are building compliance programmes directly against the EU requirements, calibrated against that framework alone.

EU Market Access Is Conditional from December 2027

From 11 December 2027, every product with digital elements placed on the EU market for the first time has to comply with the CRA's essential requirements and carry CE marking. Products already on the market before that date are exempt from the substantive requirements retrospectively, though they remain caught by the Article 14 reporting obligations that took effect in September 2026.

Every new unit, new version and substantial modification placed after 11 December 2027 has to comply in full. Organisations that delay compliance are accepting that their EU market access ends on that date.

Penalties

Non-compliance carries significant financial exposure:

1. Up to €15 million or 2.5% of worldwide annual turnover (whichever is higher) for breach of the essential requirements, conformity assessment obligations, or reporting duties
2. Up to €10 million or 2% for other manufacturer, importer and distributor obligations
3. Up to €5 million or 1% for supplying incorrect or misleading information to authorities
4. Market surveillance authorities can require withdrawal or recall of products from the EU market

The fines are calculated against a company's entire worldwide turnover, including revenue earned well outside the EU. A UK company with modest EU sales but considerable global revenue faces exposure calibrated to its full commercial scale.

The Relationship with NIS2 and DORA

The CRA sits alongside the NIS2 Directive and DORA rather than replacing either. NIS2 applies to operators of essential services; DORA applies to financial entities; the CRA applies to product manufacturers. Many organisations will find themselves subject to more than one regime at once, so mapping where they overlap and where they diverge matters for avoiding duplicated effort and compliance gaps. Our CRA vs NIS2 and DORA comparison works through the mapping in detail.

The CRA's obligations switch on in stages. Knowing which deadline applies to which obligation matters for sequencing a compliance programme.

The September 2026 reporting deadline has already passed. UK manufacturers with products on the EU market are now working under live reporting obligations, with the December 2027 deadline for full compliance fifteen months away. For a fuller breakdown of each milestone and how to sequence a readiness programme against it, see our CRA compliance timeline guide.

Understanding the CRA is the first step. Acting on it is the next. For most UK organisations, the practical starting point is a structured scoping exercise across three questions.

1. Are any of your products with digital elements placed on the EU market? This includes direct sales, sales via EU subsidiaries under your brand, and products distributed through EU partners under your trademark.
2. What is your role? Manufacturer, importer or distributor. The answer determines your obligation set and, critically, whether you carry the full burden of conformity assessment or a verification duty.
3. What product class are your products? Default, Class I, Class II or critical. The class determines the conformity assessment route and the lead time required.

From those three answers, a compliance roadmap becomes workable. The Article 14 reporting obligations are already live, so vulnerability management and incident response processes should be the immediate priority; the full Annex I requirements, technical documentation, SBOM and CE marking programme need to be in place before 11 December 2027.

SureCloud's Compliance Management module gives your team a structured, auditable place to build out a CRA framework mapping, track obligations against the requirements you've identified, and pull evidence together as your programme develops, rather than reconstructing it in a spreadsheet every time an auditor asks.