Cyber Resilience Act (CRA) (CRA)

Cyber Resilience Act (CRA)

In forceCRA

Summary

It requires security by design for products with digital elements, including AI software sold as a product. From September 2026 manufacturers must report exploited vulnerabilities and severe incidents; the remaining requirements arrive in December 2027. Software offered only as a cloud service is out of scope unless it is part of a product.

Who it applies to

Manufacturers, importers and distributors of hardware and software sold in the EU.

Penalties

Up to EUR 15M or 2.5% of worldwide turnover for breaching essential or reporting requirements.

Official name: Reglamento (UE) 2024/2847 del Parlamento Europeo y del Consejo, de 23 de octubre de 2024, relativo a los requisitos horizontales de ciberseguridad para los productos con elementos digitales (Reglamento de Ciberresiliencia)
Official reference: Reglamento (UE) 2024/2847, DO L de 20.11.2024
Regulator: National market surveillance authorities and ENISA
Official source: Check the sourceHow we verify sources

Key dates

September 11, 2026Reporting obligations
December 11, 2027Full application

Obligations and dates

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Report exploited vulnerabilities and severe incidents within 24/72 hours	Reglamento (UE) 2024/2847, art. 14	In force	September 11, 2026	If you make or sell AI software or devices as a product (not only as a cloud service). Distributors only take on this duty if they place the product on the market under their own name or substantially modify it.	Verified in the official source on October 31, 2026
Essential product cybersecurity requirements	Reglamento (UE) 2024/2847, arts. 12-14 y Anexo I	Adopted, applies later	December 11, 2027	If you make or sell AI software or devices as a product.	Verified in the official source on November 4, 2026

Report exploited vulnerabilities and severe incidents within 24/72 hours

Reglamento (UE) 2024/2847, art. 14In force

Applies from September 11, 2026

When it relates: If you make or sell AI software or devices as a product (not only as a cloud service). Distributors only take on this duty if they place the product on the market under their own name or substantially modify it.
What the rule provides: Early warning within 24 hours, notification within 72 hours and a final report, via ENISA's single reporting platform.
Inform affected users and the mitigation measures.
Typical evidence: Vulnerability handling and reporting procedure.
Notification log.
Related base documents: AI Incident Response Plan
Supporting documents: Adversarial Security and Robustness Checklist
AI Security Baseline
AI Document Control and Versioning Procedure
Third-Party and Open-Weight Model Provenance Sheet
Verification: Verified in the official source on October 31, 2026Reporting date confirmed on the Commission's official CRA reporting page (cited in the research).

Essential product cybersecurity requirements

Reglamento (UE) 2024/2847, arts. 12-14 y Anexo IAdopted, applies later

Applies from December 11, 2027

When it relates: If you make or sell AI software or devices as a product.
What the rule provides: Design secure by default, assess risks and handle vulnerabilities during the support period.
Technical documentation, EU declaration of conformity and CE marking.
High-risk AI systems that meet the CRA are deemed to meet the AI Act's cybersecurity requirements.
Since Sep 11, 2026, Article 14 already applies: report actively exploited vulnerabilities and severe incidents affecting the product's security.
Typical evidence: Cybersecurity risk assessment.
Software bill of materials (SBOM).
Related base documents: AI Security Baseline
Adversarial Security and Robustness Checklist
Supporting documents: AI Reference Architecture
AI Document Control and Versioning Procedure
Third-Party and Open-Weight Model Provenance Sheet
Verification: Verified in the official source on November 4, 2026Checked in the Official Journal (CELEX 32024R2847): Article 71(2) ("shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026"), Article 12 (high-risk AI systems), Article 13, Annex I and Article 64(2) (fines up to EUR 15M or 2.5%).