TL;DR<\/h2>\n\n- \ud83d\udd12 The CRA is an EU regulation directly applicable in all member states. No national transposition required (unlike NIS2).<\/li>\n
- \u26a0\ufe0f From September 11, 2026: Mandatory reporting of actively exploited vulnerabilities to ENISA within 24 hours.<\/li>\n
- \ud83d\udee1\ufe0f From December 11, 2027: Full compliance required. Products without a CRA-compliant CE mark cannot be sold in the EU.<\/li>\n
- \ud83d\udcca Fines: up to 15 million Euro or 2.5 percent of global annual turnover.<\/li>\n
- \ud83d\udd27 CISOs need new procurement criteria: conformity declaration, SBOM, support duration, update policy.<\/li>\n<\/ul>\n
What the CRA Regulates<\/h2>\n
The CRA applies to all “products with digital elements” – hardware and software placed on the EU market, regardless of whether the manufacturer is based in the EU. An IoT sensor from Shenzhen, a VPN client from California, and a firewall from Munich are all subject to the same rules.<\/p>\n
The law distinguishes three classes. Standard products (the majority) can be certified via self-assessment. Class I products (including password managers, VPN tools, web browsers, smart home devices, and operating systems) are subject to stricter procedures. Class II products (firewalls, intrusion detection systems, tamper-proof microprocessors) require third-party assessment by a notified body.<\/p>\n
Exemptions include non-commercial open-source software, medical devices, vehicles, and products for national security. Everything else that is digital and commercially distributed falls under the CRA.<\/p>\n
\n\nSept. 2026<\/div>\nReporting obligations active<\/div>\n<\/div>\n\nDec. 2027<\/div>\nFull compliance<\/div>\n<\/div>\n\n15 Mio. \u20ac<\/div>\nMaximum fine<\/div>\n<\/div>\n<\/div>\nThe Five Core Obligations for Manufacturers<\/h2>\n
1. Secure by Design and Default.<\/strong> Cybersecurity must be integrated from the start of development. No weak default passwords, minimized attack surface, encryption of stored and transmitted data. Automatic security updates must be supported.<\/p>\n2. Vulnerability Management and SBOM.<\/strong> Manufacturers must create a Software Bill of Materials (SBOM). Important nuance: publishing the SBOM is not mandatory. It serves internal vulnerability management and must be provided upon request by market surveillance authorities. In addition, a process for coordinated vulnerability disclosure must be established.<\/p>\n3. Reporting Obligations from September 2026.<\/strong> In case of actively exploited vulnerabilities, manufacturers must send an early warning to ENISA within 24 hours. A detailed report must follow within 72 hours, and a final report is due after 14 days.<\/p>\n4. CE Marking for Cybersecurity.<\/strong> No CE marking without CRA compliance. No CE marking, no access to the EU market. Manufacturers must issue an EU Declaration of Conformity. Importers must retain this document for ten years.<\/p>\n5. Minimum of Five Years of Security Updates.<\/strong> Manufacturers must communicate the end-of-support date and provide free security updates throughout the entire support period.<\/p>\n\n“The CRA changes the rules of the game for the entire EU digital market. For the first time, cybersecurity becomes a prerequisite for the CE marking of digital products.”
\nBSI (Federal Office for Information Security), information page on the Cyber Resilience Act<\/cite>\n<\/p><\/blockquote>\nWhat CISOs Must Change in Procurement Now<\/h2>\n
The CRA binds not only manufacturers but all economic actors along the supply chain. For CISOs and IT procurement, this means procurement criteria need updating.<\/p>\n
Seven questions procurement must ask starting in 2026:<\/strong><\/p>\n1. Is there an EU Declaration of Conformity (DoC) for the CRA?<\/p>\n
2. Is the CE marking present and related to CRA requirements?<\/p>\n
3. How long is the declared support period? What happens at end-of-support?<\/p>\n
4. Is an SBOM available (on request)?<\/p>\n
5. Which conformity assessment route was chosen?<\/p>\n
6. Is there a documented process for coordinated vulnerability disclosure?<\/p>\n
7. Does the manufacturer have a policy for automatic security updates?<\/p>\n
Procurement contracts should explicitly include CRA conformity proofs, update obligations, and end-of-support agreements. The CRA sets the standard for what constitutes a product defect.<\/p>\n
Distinctions: CRA, NIS2, DORA, and AI Act<\/h2>\n
The CRA regulates products<\/strong> prior to market authorization. NIS2<\/a> regulates organizations<\/strong> during ongoing operations. DORA<\/a> regulates financial institutions<\/strong> and their ICT providers. The AI Act regulates AI systems<\/strong> by risk class. CRA and NIS2 can apply simultaneously.<\/p>\n\n24 h<\/div>\nReporting deadline for actively exploited vulnerabilities to ENISA (from Sept. 2026)<\/div>\nSource: EU Regulation 2024\/2847 (Cyber Resilience Act)<\/div>\n<\/div>\nConclusion: Cybersecurity Becomes a Market Access Requirement<\/h2>\n
The CRA makes cybersecurity the gatekeeper to the EU market. No CE marking without security proof, no marketing without a conformity declaration, no vulnerability without a 24-hour report. Reporting obligations begin as early as September 2026. Anyone waiting until then faces a timing problem.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n\nDoes the CRA apply to software?<\/strong><\/summary>\nYes. The CRA covers all “products with digital elements,” including both hardware and software. Non-commercial open-source software developed without profit motive is exempt.<\/p>\n<\/details>\n\nMust the SBOM be published?<\/strong><\/summary>\nNo. The SBOM must be created and made available upon request by market surveillance authorities. Mandatory public publication is not required.<\/p>\n<\/details>\n\nWhat happens in case of non-compliance?<\/strong><\/summary>\nFines of up to 15 million Euro or 2.5 percent of global annual turnover. In addition, market surveillance authorities may prohibit distribution or order product recalls. In Germany, the BSI (Federal Office for Information Security) is responsible.<\/p>\n<\/details>\n\nHow are CRA and NIS2 related?<\/strong><\/summary>\nThe CRA regulates products (prior to market entry), while NIS2 regulates organizations (during operations). Both can apply simultaneously.<\/p>\n<\/details>\n\nWhat must CISOs do by September 2026?<\/strong><\/summary>\nUpdate procurement criteria, assess existing suppliers for CRA readiness, and amend procurement contracts to include conformity proofs and update obligations.<\/p>\n<\/details>\n
\nReading Tips from the Editorial Team<\/h2>\n\n- NIS2 Registration Requirement: Practical Checklist According to \u00a7 30 BSIG<\/a><\/li>\n
- DORA and NIS2 Together: Compliance Double Burden for Financial Services<\/a><\/li>\n
- Cloud Misconfigurations: The 10 Most Dangerous Security Gaps<\/a><\/li>\n<\/ul>\n<\/div>\n\n<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/nis2-compliance-monitoring-bsig-250x167.jpeg\")
<\/span>Editor’s Pick<\/span>Missed NIS2 Registration Deadline? Practical Checklist \u00a730 BSIG<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/dora-nis2-gleichzeitig-compliance-doppeldruck-finanzdienstleister-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>DORA & NIS2: How Financial Firms Manage Compliance Double\u2026<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/cloud-fehlkonfigurationen-server-rack-250x166.jpeg\")
<\/span>Editor’s Pick<\/span>Cloud Misconfigurations: Top 10 Security Gaps in AWS and Azure<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-gartner-it-spending-forecast-april-2026-64654886-250x167.jpg\")
<\/span>Digital Chiefs<\/span>Gartner: 13.5% IT Growth by 2026 \u2013 CIOs Must Shift Strategies<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-psd3-mittelstand-finanzchefs-banking-api-78939015-250x131.jpg\")
<\/span>MyBusinessFuture<\/span>PSD3 in SMEs: Preparing Finance Chiefs for Banking APIs<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-google-cloud-next-2026-agentic-cloud-roa-92019527.jpg\")
<\/span>cloudmagazin<\/span>Gemini Enterprise Pushes DACH Architects to Overhaul Their Game<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-cybersecurity-boom-nis2-deutschlands-sic-39412011-250x166.jpg\")
<\/span>MyBusinessFuture<\/span>Cybersecurity Boom: NIS2 Drives Germany\u2019s Security Growth<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The EU Cyber Resilience Act (CRA) has been in force since December 10, 2024. Reporting obligations take effect in September 2026, and by December 2027, all digital products on the EU market must meet full security requirements. For CISOs, this changes not only their own compliance landscape but the entire procurement […]","protected":false},"author":10,"featured_media":5484,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cyber resilience act","_yoast_wpseo_title":"EU Cyber Resilience Act from 2026: What CISOs Must Check When Purchasing Digital","_yoast_wpseo_metadesc":"EU Cyber Resilience Act compliance ensures secure digital products\u2014avoid penalties. Check vendor obligations and certifications now. Act before 2026.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5457"],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-7639","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":5457,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7639"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7639\/revisions"}],"predecessor-version":[{"id":21751,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7639\/revisions\/21751"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5484"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
What the CRA Regulates<\/h2>\n
The CRA applies to all “products with digital elements” – hardware and software placed on the EU market, regardless of whether the manufacturer is based in the EU. An IoT sensor from Shenzhen, a VPN client from California, and a firewall from Munich are all subject to the same rules.<\/p>\n
The law distinguishes three classes. Standard products (the majority) can be certified via self-assessment. Class I products (including password managers, VPN tools, web browsers, smart home devices, and operating systems) are subject to stricter procedures. Class II products (firewalls, intrusion detection systems, tamper-proof microprocessors) require third-party assessment by a notified body.<\/p>\n
Exemptions include non-commercial open-source software, medical devices, vehicles, and products for national security. Everything else that is digital and commercially distributed falls under the CRA.<\/p>\n
The Five Core Obligations for Manufacturers<\/h2>\n
1. Secure by Design and Default.<\/strong> Cybersecurity must be integrated from the start of development. No weak default passwords, minimized attack surface, encryption of stored and transmitted data. Automatic security updates must be supported.<\/p>\n 2. Vulnerability Management and SBOM.<\/strong> Manufacturers must create a Software Bill of Materials (SBOM). Important nuance: publishing the SBOM is not mandatory. It serves internal vulnerability management and must be provided upon request by market surveillance authorities. In addition, a process for coordinated vulnerability disclosure must be established.<\/p>\n 3. Reporting Obligations from September 2026.<\/strong> In case of actively exploited vulnerabilities, manufacturers must send an early warning to ENISA within 24 hours. A detailed report must follow within 72 hours, and a final report is due after 14 days.<\/p>\n 4. CE Marking for Cybersecurity.<\/strong> No CE marking without CRA compliance. No CE marking, no access to the EU market. Manufacturers must issue an EU Declaration of Conformity. Importers must retain this document for ten years.<\/p>\n 5. Minimum of Five Years of Security Updates.<\/strong> Manufacturers must communicate the end-of-support date and provide free security updates throughout the entire support period.<\/p>\n \n“The CRA changes the rules of the game for the entire EU digital market. For the first time, cybersecurity becomes a prerequisite for the CE marking of digital products.” The CRA binds not only manufacturers but all economic actors along the supply chain. For CISOs and IT procurement, this means procurement criteria need updating.<\/p>\n Seven questions procurement must ask starting in 2026:<\/strong><\/p>\n 1. Is there an EU Declaration of Conformity (DoC) for the CRA?<\/p>\n 2. Is the CE marking present and related to CRA requirements?<\/p>\n 3. How long is the declared support period? What happens at end-of-support?<\/p>\n 4. Is an SBOM available (on request)?<\/p>\n 5. Which conformity assessment route was chosen?<\/p>\n 6. Is there a documented process for coordinated vulnerability disclosure?<\/p>\n 7. Does the manufacturer have a policy for automatic security updates?<\/p>\n Procurement contracts should explicitly include CRA conformity proofs, update obligations, and end-of-support agreements. The CRA sets the standard for what constitutes a product defect.<\/p>\n The CRA regulates products<\/strong> prior to market authorization. NIS2<\/a> regulates organizations<\/strong> during ongoing operations. DORA<\/a> regulates financial institutions<\/strong> and their ICT providers. The AI Act regulates AI systems<\/strong> by risk class. CRA and NIS2 can apply simultaneously.<\/p>\n The CRA makes cybersecurity the gatekeeper to the EU market. No CE marking without security proof, no marketing without a conformity declaration, no vulnerability without a 24-hour report. Reporting obligations begin as early as September 2026. Anyone waiting until then faces a timing problem.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Yes. The CRA covers all “products with digital elements,” including both hardware and software. Non-commercial open-source software developed without profit motive is exempt.<\/p>\n<\/details>\n No. The SBOM must be created and made available upon request by market surveillance authorities. Mandatory public publication is not required.<\/p>\n<\/details>\n Fines of up to 15 million Euro or 2.5 percent of global annual turnover. In addition, market surveillance authorities may prohibit distribution or order product recalls. In Germany, the BSI (Federal Office for Information Security) is responsible.<\/p>\n<\/details>\n The CRA regulates products (prior to market entry), while NIS2 regulates organizations (during operations). Both can apply simultaneously.<\/p>\n<\/details>\n Update procurement criteria, assess existing suppliers for CRA readiness, and amend procurement contracts to include conformity proofs and update obligations.<\/p>\n<\/details>\n
\nBSI (Federal Office for Information Security), information page on the Cyber Resilience Act<\/cite>\n<\/p><\/blockquote>\nWhat CISOs Must Change in Procurement Now<\/h2>\n
Distinctions: CRA, NIS2, DORA, and AI Act<\/h2>\n
Conclusion: Cybersecurity Becomes a Market Access Requirement<\/h2>\n
Frequently Asked Questions<\/h2>\n
Does the CRA apply to software?<\/strong><\/summary>\n
Must the SBOM be published?<\/strong><\/summary>\n
What happens in case of non-compliance?<\/strong><\/summary>\n
How are CRA and NIS2 related?<\/strong><\/summary>\n
What must CISOs do by September 2026?<\/strong><\/summary>\n
Reading Tips from the Editorial Team<\/h2>\n
\n
Editor’s Picks<\/h3>\n
<\/span>Editor’s Pick<\/span>Missed NIS2 Registration Deadline? Practical Checklist \u00a730 BSIG<\/span><\/span><\/a><\/span>Editor’s Pick<\/span>DORA & NIS2: How Financial Firms Manage Compliance Double\u2026<\/span><\/span><\/a><\/span>Editor’s Pick<\/span>Cloud Misconfigurations: Top 10 Security Gaps in AWS and Azure<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
<\/span>Digital Chiefs<\/span>Gartner: 13.5% IT Growth by 2026 \u2013 CIOs Must Shift Strategies<\/span><\/span><\/a><\/span>MyBusinessFuture<\/span>PSD3 in SMEs: Preparing Finance Chiefs for Banking APIs<\/span><\/span><\/a><\/span>cloudmagazin<\/span>Gemini Enterprise Pushes DACH Architects to Overhaul Their Game<\/span><\/span><\/a><\/span>MyBusinessFuture<\/span>Cybersecurity Boom: NIS2 Drives Germany\u2019s Security Growth<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The EU Cyber Resilience Act (CRA) has been in force since December 10, 2024. Reporting obligations take effect in September 2026, and by December 2027, all digital products on the EU market must meet full security requirements. For CISOs, this changes not only their own compliance landscape but the entire procurement […]","protected":false},"author":10,"featured_media":5484,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cyber resilience act","_yoast_wpseo_title":"EU Cyber Resilience Act from 2026: What CISOs Must Check When Purchasing Digital","_yoast_wpseo_metadesc":"EU Cyber Resilience Act compliance ensures secure digital products\u2014avoid penalties. Check vendor obligations and certifications now. Act before 2026.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5457"],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-7639","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":5457,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7639"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7639\/revisions"}],"predecessor-version":[{"id":21751,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7639\/revisions\/21751"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5484"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}