Cyber Resilience Act: getting your products ready for CE marking

Any manufacturer placing on the EU market a product with digital elements whose intended use includes a direct or indirect data connection to a device or network: connected objects, industrial equipment, installed software, firmware, and the remote data processing solutions the product needs to function. Importers and distributors also have verification duties.

Products already covered by equivalent sector rules are excluded — medical devices (MDR) and in vitro diagnostic devices (IVDR), vehicles, aviation, marine equipment — as are SaaS services not tied to a product, which fall under NIS2.

Regulation (EU) 2024/2847 entered into force on 10 December 2024. Provisions on notified bodies have applied since 11 June 2026, and the obligation to report actively exploited vulnerabilities and severe incidents since 11 September 2026, for all products already on the market. All requirements apply from 11 December 2027.

Reporting follows a tight schedule: early warning within 24 hours, notification within 72 hours, then a final report, through ENISA's single reporting platform.

Meeting the CRA essential requirements becomes a condition for CE marking. The manufacturer carries out a conformity assessment, draws up the technical documentation and the EU declaration of conformity, then affixes the CE marking.

For most products, self-assessment is enough. Class I "important" products must apply a harmonised standard or go through a notified body; Class II and "critical" products require third-party assessment or certification.

Medical devices and in vitro diagnostic devices are excluded from the CRA, as the MDR and IVDR already govern their cybersecurity. However, products in your range that are not qualified as medical devices — gateways, wellness devices, companion apps, non-medical hospital equipment — are in scope.

A single programme (SBOM, vulnerability handling, secure development) meets both frameworks: we help you qualify each product and pool the evidence.

In the United States, section 524B of the Federal Food, Drug, and Cosmetic Act has required "cyber devices" since 2023 to have a plan to monitor and address vulnerabilities, including coordinated disclosure, secure design and update processes, and a software bill of materials (SBOM).

These requirements largely overlap with CRA Annex I. A medtech manufacturer can build a single foundation — CVD process, SBOM, NIST SSDF — reusable for the FDA submission and for the CE marking of its non-medical products.

Failure to meet the essential requirements can lead to fines of up to €15 million or 2.5% of worldwide annual turnover. Market surveillance authorities can also require the product to be recalled or withdrawn.