Achieve EU Cyber Resilience Act Compliance with Confidence

The CRA is an EU regulation establishing mandatory cybersecurity requirements for products with digital elements sold in the European Union. It covers hardware and software, requiring secure-by-design development, vulnerability handling, and ongoing security updates throughout the product lifecycle.

The CRA entered into force in December 2024. Vulnerability reporting obligations begin in September 2026, and full application of all requirements starts in December 2027.

Pure SaaS is generally outside the CRA's direct scope, but software components and remote data processing solutions intended to support a product with digital elements are covered. The line is nuanced and depends on whether the software is integral to the product's function.

The CRA requires SBOMs in a commonly used machine-readable format. CycloneDX and SPDX are the two industry-standard formats that meet this requirement and are supported by Interlynk out of the box.

Non-commercial open-source software is exempt. However, open-source components integrated into commercial products are not — manufacturers remain responsible for the security of all components they ship, including open-source dependencies.

Penalties can reach up to €15 million or 2.5% of global annual turnover, whichever is higher, for the most serious violations. Lesser breaches carry lower but still substantial fines.

NIS2 targets operators of essential and important services, focusing on organizational cybersecurity. The CRA targets products themselves, regulating manufacturers of hardware and software placed on the EU market.

Yes. Any company — regardless of headquarters location — that places products with digital elements on the EU market must comply with the CRA. Non-EU manufacturers typically appoint an EU-based authorized representative.