IN SHORT
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the European Union law that makes a software bill of materials mandatory.
If you sell a product with digital elements into the EU, you have to produce a machine-readable SBOM, keep it updated, and hand it over whenever a market surveillance authority asks for it.
Two dates matter. Vulnerability reporting starts on 11 September 2026, and the rest of the obligations, SBOM included, apply from 11 December 2027. That ordering catches people out. Reporting starts fifteen months before the SBOM is formally due, and you cannot report on a component you have never inventoried.
The law asks only for your top-level dependencies. But that's the same gap that let Log4Shell slip through.
What is the Cyber Resilience Act?
The EU Cyber Resilience Act (CRA) is the first horizontal EU regulation imposing mandatory cybersecurity requirements on hardware and software products with digital elements. It mandates secure-by-design principles, vulnerability handling, and lifecycle transparency for any product sold in the EU market, regardless of where the manufacturer is based.
EURO 15M
24 Hours
10 Years
90%
CRA Compliance Timeline
Who Does the CRA Affect?
The CRA applies to any product with digital elements placed on the EU market. That covers software sold on its own, hardware with embedded software, and the remote data-processing solutions those products depend on. A hospital infusion pump, an industrial controller, a mobile app and a firewall appliance all sit inside the same regulation.
Three roles carry obligations, and they are not interchangeable.
Manufacturers
Anyone who develops, manufactures, or has products with digital elements designed and developed under their name or trademark.
Importers
Entities established in the EU that place a product with digital elements bearing a third-country manufacturer's name on the EU market.
Distributors
Any party in the supply chain, other than the manufacturer or importer, who makes a product with digital elements available in the EU market.
Product Classification Under CRA
Default (~90%)
Important Class I
Important Class II
Critical
SBOM Requirements Under CRA
The Cyber Resilience Act mandates comprehensive Software Bill of Materials documentation. The obligation is set out in Article 13(1)(h) together with Annex I, Part II, point (1) of Regulation (EU) 2024/2847.
Here are the key requirements you need to meet:
The CRA asks only for top-level dependencies. That is the same gap that hid Log4j inside a framework inside a library during Log4Shell, so treat it as a floor rather than a target.
Vulnerability Reporting Obligations
Article 71(2) brings Article 14 forward to 11 September 2026, ahead of the rest of the regulation. Two events trigger a report: a vulnerability in your product being actively exploited, and a severe incident affecting its security.
24h
Clock starts at awareness, not confirmation
72 hrs
Initial severity assessment and mitigations
14 days
A workaround counts as a corrective measure
1 month
Runs from the 72-hour notification
WORTH KNOWING
Only actively exploited vulnerabilities and severe incidents are reportable. Flaws you find and fix before exploitation stay in normal vulnerability handling.
Applies to products already on the EU market, not only those placed after September 2026.
One submission through the ENISA Single Reporting Platform (Article 16) reaches both ENISA and your coordinating national CSIRT.
Microenterprises and small enterprises cannot be fined for missing the 24-hour early warning (Article 64(10)(a)). The obligation itself, and the later deadlines, still apply.
The CRA sets no deadline for developing the fix, but "without undue delay" applies and affected users must be informed under Article 14(8).
NEW • FREE RESOURCE
Use our free evaluation rubric to find the one that fits your needs.
A demo and a sales pitch won’t tell you whether an SBOM platform holds up under the CRA. So we built this rubric. It’s a vendor-neutral way to test any platform, including your own, against what the CRA and BSI TR-03183-2 require. There are 66 checks across seven areas, each tied to a specific CRA or BSI requirement, and the summary tab does the math. By the end you can see where each tool is strong and where it falls short. Critical items are flagged, so a dealbreaker can’t slip past.
Generation
Content & Quality
Lifecycle
Vuln & VEX
Format
Integration
Beyond CRA
Get the rubric
Tell us where to send it and we’ll email it over.
How Interlynk Helps?
We map every CRA requirement to a concrete platform capability, so you can demonstrate compliance, not just claim it.
FAQs
What is the EU Cyber Resilience Act?
The CRA is an EU regulation establishing mandatory cybersecurity requirements for products with digital elements sold in the European Union. It covers hardware and software, requiring secure-by-design development, vulnerability handling, and ongoing security updates throughout the product lifecycle.
When does the CRA take effect?
Is SaaS covered by the CRA?
What SBOM format does the CRA require?
Is open-source software exempt from the CRA?
What are the penalties for CRA non-compliance?
How does the CRA differ from NIS2?
Do US companies need to comply with the CRA?
Are top-level dependencies enough for CRA compliance?
Trusted by 100+ Organizations
Join 100+ organizations already using Interlynk to automate SBOM management and meet EU regulatory requirements.