§ 01
Mitä Cyber Resilience Act edellyttää
Regulation (EU) 2024/2847 introduces EU-wide cybersecurity obligations for hardware and software with digital elements, including:
- 01Secure-by-design development against essential cybersecurity requirements
- 02Vulnerability handling across the product lifecycle, including security updates
- 03Reporting of actively exploited vulnerabilities and severe incidents — 24-hour early warning, 72-hour notification, then a final report
- 04CE marking backed by conformity assessment (notified bodies for important and critical products)
§ 02
Soveltamisaikataulu
Key CRA milestones manufacturers should plan against:
| Virstanpylväs | Päivämäärä | Tila |
|---|---|---|
| Entry into force | 10 Dec 2024 | In force |
| Vulnerability & incident reporting | 11 Sept 2026 | Approaching |
| Full obligations · CE marking | 11 Dec 2027 | Horizon |
§ 03
Mitä valmistelemme
We act as your reporting concierge — not as a notified body. Where third-party conformity assessment is required, notified bodies certify.
- 01Secure intake of product, security, and vulnerability information
- 02Submission-ready CRA reports: early warnings, 72-hour notifications, and final reports
- 03Supporting technical documentation — risk assessment, SBOM, support periods, and update policy
§ 04Usein kysytyt kysymykset
Who is in scope of the Cyber Resilience Act?
Manufacturers of products with digital elements placed on the EU market — from consumer devices to enterprise software — subject to the regulation’s definitions and product categories. Distributors and importers have related duties under the CRA framework.
When do CRA reporting duties start?
Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026. Broader secure-by-design and CE marking obligations apply from 11 December 2027.
Do you replace a notified body?
No. We prepare documentation and submission-ready reports. Conformity assessment for important and critical products is performed by notified bodies where required.
What information do you need from us?
Typically product inventory, security architecture notes, vulnerability handling processes, incident facts, SBOM or component lists, and support/update policy details. We provide a structured intake checklist per engagement.
Kartoittakaa CRA-raportoinnin valmius
Jakakaa tuoteportfolio ja aikahorisontti. Laadimme intaken haavoittuvuusilmoituksille ja dokumentaatiolle.