Skip to content
Complia
All frameworks

EU regulation · Regulation (EU) 2024/2847

EU Cyber Resilience Act

The CRA sets cybersecurity requirements for products with digital elements made available on the EU market – hardware and software, including components placed on the market separately. Manufacturers must design products securely, handle vulnerabilities throughout the support period, keep technical documentation and report actively exploited vulnerabilities and severe incidents.

Checked 18 Oct 2026

What it asks of product teams

  • Security requirements for the product itself and for how vulnerabilities are handled (Annex I, parts I and II).
  • A cybersecurity risk assessment, kept with the technical documentation.
  • Knowledge of the components in the product, including a software bill of materials.
  • Security updates and vulnerability handling for the whole support period.
  • Conformity assessment, an EU declaration of conformity and CE marking.
  • Timely reports of actively exploited vulnerabilities and severe incidents.

How Complia supports the work

  • 01

    Both parts of Annex I

    Requirements for what the product must withstand and for how you handle vulnerabilities, each traced to its legal reference.

  • 02

    Reporting clocks

    Article 14 cases show the 24-hour, 72-hour and final-report deadlines, and drafts are prepared in the case. You submit through the Single Reporting Platform.

  • 03

    SBOM, vulnerabilities and VEX

    Import a software bill of materials, triage vulnerabilities per component and record VEX statements – also from your CI pipeline.

  • 04

    Declaration as a controlled version

    The EU declaration of conformity is issued from an approved baseline as a locked, numbered version, signed by someone other than the person who prepared it.

What stays with you

Whether a product is in scope, its product category, which conformity assessment route applies and what you report are your decisions. Complia records each assessment and its rationale – it does not make it.

Other frameworks

See it with your own product.

We go through your requirements, owners and next steps in a walkthrough.

Book a walkthrough