Product classification and conformity route
Default, important (Class I or II) or critical product, and the matching route: internal control, EU-type examination or full quality assurance.
Home / Compliance / EU Cyber Resilience Act
Compliance · For manufacturers and integrators
EU Cyber Resilience Act (CRA) for industrial products
The CRA makes cybersecurity a condition for placing products with digital elements on the EU market. We combine the EN 40000 horizontal standards, the vertical standards and IEC 62443-4-1 / -4-2, so one set of evidence covers them all.
11 Sep 2026Reporting obligations apply (Art. 14)
24 h · 72 hEarly warning and notification to the CSIRT and ENISA
11 Dec 2027Full application; CE marking required
EN 40000 + IEC 62443-4One evidence set for horizontal and industrial standards
Where the CRA stands
Reporting is already live. CE marking is next.
- 10 December 2024Regulation (EU) 2024/2847 enters into force.
- 11 June 2026Provisions on notification of conformity assessment bodies apply.
- 11 September 2026Manufacturers must report actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours, then a final report.
- 11 December 2027All obligations apply. Products must meet the essential requirements and carry the CE marking.
Two sides of the CRA
For the products you build, and the products you buy
Manufacturers and integrators
Classify each product, choose the conformity route, build security into the development lifecycle, handle vulnerabilities for the support period, and keep the technical file ready for self-assessment or a notified body.
Asset owners and operators
Write CRA conformity into your tenders and contracts, so the OEMs, integrators and EPCs you buy from deliver products and evidence that also serve your NIS 2 and IEC 62443 obligations (A5 Supply-chain security).
What you get
From classification to technical file
Product risk assessment and secure development lifecycle
A documented cybersecurity risk assessment for each product, and IEC 62443-4-1-aligned development processes (SM, SR, SD, SI, SVV, DM, SUM, SG).
Security requirements and evidence
Essential requirements mapped to EN 40000 and IEC 62443-4-2 component requirements, so one set of evidence serves the CRA and your industrial customers.
Vulnerability handling and reporting readiness
Coordinated vulnerability disclosure policy, SBOM management, and procedures and roles to meet the 24-hour, 72-hour and final-report deadlines.
Technical documentation and EU declaration of conformity
A technical file ready for self-assessment or a notified body.
Verification
Product security and penetration testing, and system security level verification (C4 Assurance & verification).
Related services and training
How we help
A6
EU Cyber Resilience Act (CRA)
Classification, secure development lifecycle, vulnerability handling, technical file.
A5Supply-chain security
CRA conformity requirements for the products you buy, in tenders and contracts.
C4Assurance & verification
Product and system testing, carried out safely by people who know industrial systems.
Is your product default, important or critical?
Send us a short product description. We will come back with the likely class, the conformity route and a first plan.
References: Regulation (EU) 2024/2847 (Cyber Resilience Act), Arts. 14 and 71; Annex I. Harmonised standards under the CRA are still being published. This page is general information, not legal advice.