What does the CRA require of products with digital elements?

01

Products with digital elements - what are they?

Hardware and software whose use includes a direct or indirect connection to another device or a network. This includes, for example, connected household appliances, smart locks, industrial control systems, routers, mobile apps and standalone software, as well as remote data processing needed for the product to work. Standalone cloud services (SaaS) are generally not covered by the CRA but by NIS2.

02

Essential cybersecurity requirements

The product must be designed, developed and produced to ensure an appropriate level of cybersecurity based on the risks. Among other things, this means:

• No known exploitable vulnerabilities when placed on the market.
• A secure-by-default configuration, with the ability to reset the product.
• Protection against unauthorised access through appropriate authentication and access control.
• Protection of stored and transmitted data, for example through encryption.
• Minimisation of data and of the attack surface.
• Security updates, automatic by default where applicable, with an option to opt out.
• Logging of security-relevant events.

03

Vulnerability handling and support period

The manufacturer must handle vulnerabilities throughout the support period, which must be at least five years unless the product is expected to be in use for less time. Among other things:

• A software bill of materials (SBOM) covering at least the product's top-level dependencies.
• Regular testing and remediation of vulnerabilities without delay, with free security updates.
• A coordinated vulnerability disclosure policy and a contact address for reports.
• Reporting of actively exploited vulnerabilities and severe incidents (in force since 11 September 2026).

04

Technical documentation and CE marking

Before placing the product on the market, the manufacturer must carry out a risk assessment, draw up technical documentation, complete a conformity assessment, issue an EU declaration of conformity and affix the CE marking. The documentation and declaration must be kept for at least ten years after the product is placed on the market, or for the support period if longer. Users must be told, among other things, when the support period ends and how to use the product securely.

05

Default, important and critical products

The category determines how conformity is assessed:

• Default - most products. The manufacturer can self-assess.
• Important class I (Annex III), e.g. password managers, VPNs and routers - self-assessment is enough if harmonised standards are applied in full, otherwise a notified body is needed.
• Important class II (Annex III), e.g. firewalls and intrusion detection systems - requires assessment by a notified body.
• Critical (Annex IV), e.g. smart cards and hardware devices with security boxes - may require European cybersecurity certification.

06

Importers and distributors

An importer may only place compliant products on the market and must check that the manufacturer has carried out the assessment, drawn up the documentation and affixed the CE marking. A distributor must check the CE marking and that information and instructions are included. Anyone who markets a product under their own name, or substantially modifies it, is treated as the manufacturer and takes on the manufacturer's obligations.

07

Open source

Free and open-source software developed or supplied outside a commercial activity is not covered. However, anyone who integrates open source into a commercial product is responsible for the whole product, including its components, and must exercise due diligence when choosing them. Foundations and similar bodies that support commercially used open source can take on the new, lighter role of open-source software steward.