Cyber Resilience Act
With the Cyber Resilience Act, the EU is, for the first time, creating uniform requirements for the cybersecurity of products with digital elements – from software to connected devices. Manufacturers and suppliers will be legally obligated to comply with security standards throughout the entire product lifecycle.
Get started now – we'll support you.
Why act now?
The CRA requirements will come into effect gradually – with some short transition periods. Those who act early will not only secure market access but also gain a competitive advantage through increased trust among customers and partners.
Key dates at a glance
-
November 20, 2024 - Publication of the CRA in the Official Journal of the EU
-
December 10, 2024 - Entry into force of the regulation – publication after 20 days
-
June 11, 2026 - Start of requirements for conformity assessment bodies (18 months)
-
September 11, 2026 - Start of the reporting obligation for exploitable vulnerabilities and cyber incident reporting (21 months)
-
December 11, 2027 - Full application of the regulation – from now on, only CRA-compliant products may be marketed (36 months)
Recommendation for action
-
By mid-2026: Evaluate your products, processes, and employee training – especially for reporting structures.
-
From late summer 2026: Establish an effective vulnerability reporting system.
-
By the end of 2027: Ensure full compliance (CE marking, SBOM, security updates, secure-by-design).
-
Additionally: The BSI IT Security Label makes cybersecurity a selling point and increases trust in digital products. The requirements are aligned with the CRA, making the label the ideal complement.
Are your products CRA Ready?
Find out with our free CRA Readiness Check - Self Assessment:
Fit for products with digital elements
CRA Readiness Check
We analyze your company's current position with regard to the CRA requirements:
-
Auditing your products and processes for compliance
-
Identifying areas of action and risks
-
Understandable recommendations for action to meet CRA requirements
Goal: An understanding of your starting point, situation and necessary preparatory measures.
What our customers say
"We [work] with SC&E Advisory GmbH to ensure we meet all legal and compliance requirements - from the GDPR to the upcoming Cyber Resilience Act. These are crucial milestones on the way to market readiness."
Sabrina Fischer, Founder of Flite GmbH
Products with digital elements -
legally compliant and market-ready
Advice on meeting CRA requirements
We accompany you step by step on the path to compliance:
-
Support with the technical and organizational implementation of CRA requirements
-
Development of a risk-based vulnerability management system
-
Establishment of reporting processes to authorities
-
Integration of secure-by-design and secure-by-default principles
-
Advice on CE marking and documentation requirements
Goal: Sustainable and legally compliant implementation of the requirements - efficient, practical and tailored to your products.
