EU Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847 sets cybersecurity rules for products with digital elements. Chat has article-level CRA knowledge, including the 11 September 2026 reporting clocks.
Inhalt auf Englisch
The Cyber Resilience Act is Regulation (EU) 2024/2847. It is in force. It applies to products with digital elements placed on the EU market: hardware and software that can connect to a device or a network.
Full application is 11 December 2027. Article 14 reporting of actively exploited vulnerabilities and severe incidents applies earlier, from 11 September 2026, including to in-scope products already on the market.
Who it covers
- Manufacturers, importers, and distributors of products with digital elements
- Open-source software stewards when they systematically support FOSS products intended for commercial activities
- Notified bodies and market surveillance authorities for conformity and enforcement
Typical in-scope products: firmware, connected devices, operating systems, applications, and other products whose reasonably foreseeable use includes a data connection.
Sectoral carve-outs exist (for example certain medical, aviation, and automotive products already covered by other EU rules). National-security and identical spare-part exclusions also exist. Ask Chat with your product type if you need the article-level boundary.
What Chat can do
ISMS Copilot Chat now has a dedicated CRA knowledge pack (Regulation (EU) 2024/2847 at article and point level). You can ask for:
- Manufacturer duties (Art. 13), including support period and vulnerability handling
- The Art. 14 reporting cascade (24h / 72h / 14-day / 1-month clocks)
- Essential cybersecurity requirements and SBOM expectations
- Conformity routes, CE marking, and Annex III / IV product classes
- How CRA sits next to NIS 2 for a connected-product operator
In the composer, name Cyber Resilience Act, Regulation (EU) 2024/2847, or CRA SBOM / CRA vulnerability reporting. Bare "CRA" without an EU-product cue is ignored so US Community Reinvestment Act and Canada Revenue Agency questions do not pull EU product law.
Beyond and Think work for longer CRA implementation guides. Fast is enough for a clock or article lookup.
Dates that matter
| When | What |
|---|---|
| 10 December 2024 | Entry into force |
| 11 June 2026 | Chapter IV (notified bodies) applies |
| 11 September 2026 | Article 14 reporting applies |
| 11 December 2027 | The rest of the regulation applies |
Products placed on the market before 11 December 2027 are covered on a substantial modification, except Article 14 reporting, which applies to those in-scope products from 11 September 2026.