EU Cyber Resilience Act enters into force, reaching software with digital elements

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, sets horizontal cybersecurity requirements for products with digital elements, covering hardware and software placed on the EU market.

It entered into force on 10 December 2024, opening a staged compliance timeline that runs through 2027.

What it is

The regulation is described as being on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828.

Its scope reaches all products with digital elements, including both hardware and software that are designed to connect to other devices or networks.

The stated aim is to make sure all digital products are safe from cyber threats.

What it requires

The CRA introduces mandatory cybersecurity requirements for manufacturers, covering the planning, design, development and maintenance of such products.

Compliant products will bear the CE marking to indicate that they comply with the CRA requirements.

The CRA entered into force on 10 December 2024, and the main obligations introduced by the Act will apply from 11 December 2027, with reporting obligations to apply as of 11 September 2026.

Breaches of the CRA can attract fines of up to 15 million euros or 2.5% of worldwide annual turnover.

What security leaders should do

Because the CRA defines its scope by connectivity rather than by the technology inside a product, software that embeds AI components but is still designed to connect to other devices or networks appears to fall within the same category of products with digital elements as any other connected software. Security leaders should inventory network-connected products, including those with AI-driven features, and confirm with legal and compliance teams whether each qualifies as a product with digital elements under the regulation. Vulnerability-handling and incident-detection processes should be built out well before the 11 September 2026 reporting deadline, since that obligation reaches products already on the market rather than only new releases. Teams should also begin technical documentation and conformity-assessment planning now so that essential cybersecurity requirements and CE marking can be met by the 11 December 2027 full-application date, rather than treating that date as the first milestone to plan against.