Cyber Resilience Act (CRA)
- European Union
- Cybersecurity
European Union · Law or regulation · Partly applicable
The CRA, in force since December 10, 2024, addresses product cybersecurity and vulnerability handling. Manufacturer reporting obligations for actively exploited vulnerabilities and severe security incidents apply from September 11, 2026. The main requirements apply from December 11, 2027. Next key date: December 11, 2027 (Main CRA requirements apply). Last verified October 29, 2026.