Cyber Resilience Act
CRA-compliant to market, without risking access
We establish whether the CRA applies to you, run the conformity assessment and take your products with digital elements safely through to CE marking.
Find out whether you are affectedHow we work together
No obligation, no sales pressure
EU Cyber Resilience Act (CRA)
Annex III/IVCE from 2027
The reality
Without CRA conformity, affected products may no longer be sold in the EU from 2027. Here, compliance is the condition for market access, not a nice-to-have.
The risk of waiting
Up to €15m or 2.5 % of global turnover. Reporting duties from 11 September 2026, full application from 11 December 2027, classification under Annex III/IV.
The advantage of acting
Whoever has the CE marking early secures market access while competitors without a conformity assessment are held up from 2027.
Which companies does the Cyber Resilience Act apply to?
Manufacturers of devices, machines and controllers
Their products stay on the market for a long time and rarely receive updates. That is exactly where the reporting duty bites first.
Manufacturers of software, apps and SDKs
They build on open-source libraries and frameworks whose dependencies hardly anyone knows in full.
Importers and distributors
They may only place conforming products on the market and have duties of their own to check products and to inform manufacturers and authorities.
What you get
Technical implementation (SDLC, SBOM, secure coding)? Talk to us about it.
- Applicability assessmentClarity on whether, and with which products, you fall under the Cyber Resilience Act.
- Risk classificationYour products classified under Annexes III and IV, with the assessment procedure that goes with it.
- Conformity assessmentYour products measured against the CRA requirements, with the gaps and the measures to close them.
- Technical documentationThe documents the law requires, prepared so that they hold up in an inspection.
- CE markingSupport through to the declaration of conformity and the CE marking of your products.
- Reporting workflowA defined procedure for reporting exploited vulnerabilities and incidents within the deadlines.
By now many manufacturers know that their products fall under the CRA and have taken first measures. The question we hear most often after that is: is this enough?
How we work together
Applicability & classification
Does your product fall under the CRA? Classification under Annex III/IV.
Conformity assessment & documentation
The requirements, the technical documentation, the evidence.
CE marking & reporting
Declaration of conformity and a reporting workflow (ENISA).
Do you sell products with digital elements in the EU?
We will establish whether the CRA applies to you in a short conversation.
- No obligation
- No sales pressure
Frequently asked questions
Which products fall under the Cyber Resilience Act?
In principle the Cyber Resilience Act covers every "product with digital elements" that contains software or network-connected hardware and is placed on the EU market: from smart home devices through industrial controls to plain standard software. Areas already covered by other regulations are excluded — medical devices or certain automotive components, for instance. Annexes III and IV classify "important" and "critical" products for which stricter conformity assessment procedures apply, firewalls, operating systems or password managers among them. Reporting duties for actively exploited vulnerabilities apply from 11 September 2026, while the full CE marking obligation takes effect on 11 December 2027. Companies that start their technical documentation only then regularly find themselves short of time.
Does this only affect hardware, or software as well?
Software with digital elements falls under the CRA too in principle; the exact classification depends on the product.
We only distribute, we do not manufacture — are we affected?
To a lesser extent, but yes: distributors also have duties to check and to inform, towards manufacturers and authorities alike.
Let's talk about your project.
Tell us what you have in mind. Your message goes straight to our team.
Daniel Tölgyesi
CEO
Loading the form …