The EU Cyber Resilience Act: What UK Product Makers Must Do

The EU Cyber Resilience Act (CRA) makes cybersecurity a legal condition of selling hardware and software products in the EU, and it applies to UK manufacturers whose products reach EU customers. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026. The full set of obligations, including CE marking against the essential requirements, applies from 11 December 2027.

This guide is based on the published text of Regulation (EU) 2024/2847. It is not legal advice, and Sovereign Secure is not a notified body: our role is the security testing and code review that give you evidence for your conformity assessment.

What is the EU Cyber Resilience Act?

The Cyber Resilience Act is an EU regulation, so it applies directly in every member state. It sets mandatory cybersecurity requirements for products with digital elements across their life: design, development, production and a support period after sale. As with other EU product legislation, market surveillance authorities can restrict, withdraw or recall products that do not comply.

The main duties fall on manufacturers, with supporting duties for importers and distributors. Where NIS2 regulates organisations providing essential and important services (see our NIS2 guide), the CRA regulates products.

If a product includes AI, the EU AI Act can apply alongside the CRA. Under CRA Article 12, a product that is a high-risk AI system and meets the CRA’s essential cybersecurity requirements is deemed to meet the AI Act’s cybersecurity requirements. Our AI governance guide covers the AI Act.

What counts as a product with digital elements?

It is any hardware or software product, including components sold separately, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Remote data processing solutions count as part of the product, so the cloud service a smart device needs in order to work is in scope with it.

Does the Cyber Resilience Act apply to UK companies?

Yes. The CRA applies to products placed on the EU market, wherever the manufacturer is based. A UK company selling connected products to EU customers, directly or through an importer, carries the manufacturer’s obligations for those products.

Because importers must check conformity before selling, expect EU importers and distributors to ask for evidence, and to add CRA clauses to distribution contracts, well before December 2027.

Selling only in Great Britain? The CRA does not apply there. (Northern Ireland follows some EU product rules under the Windsor Framework, so take advice if you sell there.) Great Britain has its own regime under the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, in force since 29 April 2024 for consumer connectable products: no universal default passwords, a published way to report security issues and a stated minimum update period. See the PSTI product security regime on gov.uk.

When does the Cyber Resilience Act apply?

Products placed on the market before 11 December 2027 only have to meet the wider requirements if they are substantially modified after that date, but the reporting duty applies to them already.

What are the Cyber Resilience Act requirements?

The essential requirements in Annex I come in two parts, applied according to a cybersecurity risk assessment that the manufacturer must carry out and document.

Product security properties (Part I). Products must be made available on the market without known exploitable vulnerabilities and with a secure-by-default configuration that can be reset. They must be able to receive security updates (automatic by default where applicable, with an opt-out), control access through authentication, protect the confidentiality and integrity of data and configuration, process only the data they need, protect essential functions, limit attack surfaces, use exploitation mitigation, record security events and let users delete their data securely.

Vulnerability handling (Part II). Manufacturers must:

• document components, including a machine-readable software bill of materials (SBOM) covering at least top-level dependencies;
• fix vulnerabilities without delay, separating security updates from feature updates where feasible;
• apply effective and regular tests and reviews of the product’s security;
• run a coordinated vulnerability disclosure policy with a contact address, and publish details of fixed vulnerabilities;
• distribute updates securely and free of charge.

Article 13 adds a due diligence duty for third-party components, including open-source libraries, so that they do not compromise the product’s security.

Support period. At least five years of security updates, unless the product is expected to be in use for less. Each update must stay available for 10 years or the rest of the support period, whichever is longer, and technical documentation must be kept for 10 years or the support period if longer.

Which conformity assessment route applies to your product?

Most products are default products and can be self-assessed. Products whose core functionality matches a category in Annex III (important) or Annex IV (critical) need more; Implementing Regulation (EU) 2025/2392 describes those categories.

What must manufacturers report, and how fast?

Since 11 September 2026, manufacturers must notify actively exploited vulnerabilities and severe incidents affecting their products, at the same time to the coordinating CSIRT and to ENISA, through ENISA’s single reporting platform. Deadlines run from when you become aware.

An incident is severe if it harms, or could harm, the product’s ability to protect the availability, authenticity, integrity or confidentiality of important data or functions, or if it has led, or could lead, to malicious code being introduced or run. You must also tell affected users what happened and what they can do. A UK manufacturer with no EU establishment reports to the CSIRT in the member state of its authorised representative, or failing that its importer, then its distributor, then where most of its users are.

How do penetration testing and code review support CRA compliance?

The CRA does not name a specific test, but “no known exploitable vulnerabilities” and “effective and regular tests and reviews” both need findings, fixes and retest results you can file in the technical documentation.

Testing feeds your risk assessment and any notified body’s review; it does not replace either.

What are the penalties under the Cyber Resilience Act?

Breaching the essential requirements or the manufacturer obligations in Articles 13 and 14 can bring fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Most other obligations carry up to €10 million or 2%, and misleading information up to €5 million or 1%. Authorities can also order non-compliant products off the market.

Is the Cyber Resilience Act the same as the UK Cyber Security and Resilience Bill?

No. The CRA is EU product law for hardware and software sold into the EU. The UK Cyber Security and Resilience Bill updates the NIS Regulations 2018 for essential and digital services and their suppliers. The Great Britain rules for consumer devices are the PSTI regime above, so a device maker selling in both markets may need to meet the CRA and PSTI for the same product.

CRA compliance checklist: how should UK product makers prepare?

Start with reporting, because it already applies, then work back from 11 December 2027 for everything else. Use this checklist to track where each product stands:

Why Sovereign Secure

• Hardware and IoT testing across device, firmware, radio interfaces, companion apps and cloud APIs, including POS and PIN entry devices.
• PCI SSC-approved QSA, QPA and CPSA company and GEAR member 2026 to 2028, so we are used to testing against formal requirements and documenting evidence for assessment.
• ISO 27001 certified, with consultancy on secure development and vulnerability management.
• UK company since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
• Clear about our role: we are not a notified body and do not carry out CRA conformity assessments.

Plan your CRA testing

Tell us which products you sell into the EU, their likely category and your release dates, and we will scope testing and code review against the essential requirements for a fixed quote. Request a penetration testing quote or call +44 161 523 5276.