The Cyber Resilience Act (CRA) explained

01

What is the CRA?

The CRA is an EU regulation, which means it applies directly in Sweden without first being turned into Swedish law. It covers products with digital elements - hardware and software that can connect to another device or a network. The idea is that security is built in from the start and maintained throughout the product's lifetime, and that compliant products carry the CE marking. Some products already covered by their own rules, such as medical devices and vehicles, are excluded.

02

Who is covered?

The requirements target the economic operators placing products on the EU market:

• Manufacturers - whoever develops or manufactures the product, or has it done, and markets it under their own name. Manufacturers carry most of the requirements.
• Importers - must check that products from outside the EU meet the requirements before placing them on the market.
• Distributors - must check, among other things, the CE marking and documentation.
• Open-source software stewards - a new, lighter role for foundations and similar bodies that support open source used commercially.

03

Timeline

The CRA is phased in:

• 10 December 2024 - the regulation enters into force.
• 11 June 2026 - the rules on notified bodies (Chapter IV) apply.
• 11 September 2026 - manufacturers must report actively exploited vulnerabilities and severe incidents.
• 11 December 2027 - the regulation applies in full.

04

Product categories

Most products fall into the default category, where the manufacturer can assess conformity itself. Products with more important security functions are classed as important (class I or II) or critical and require more: applying harmonised standards or an assessment by a notified body, and for critical products possibly certification. Examples of important products are password managers, VPNs, routers and firewalls.

05

Penalties

Non-compliance with the essential cybersecurity requirements or the manufacturer's obligations, including reporting, can lead to fines of up to €15 million or 2.5 percent of global annual turnover, whichever is higher. Other infringements can lead to up to €10 million or 2 percent, and incorrect information to authorities up to €5 million or 1 percent. Non-compliant products can also be withdrawn from the market.

06

Authorities in Sweden

Sweden has adopted a law with provisions supplementing the regulation. The Swedish Post and Telecom Authority (PTS) is the market surveillance authority and checks that products meet the requirements. Vulnerability and incident reports are submitted through ENISA's single reporting platform to CERT-SE, which was previously part of MSB and since 1 July 2026 is part of the National Cybersecurity Center (NCSC).

07

Relationship to NIS2

NIS2 and the Cybersecurity Act regulate organisations and how they protect their services. The CRA regulates products. A manufacturer can be covered by both: the CRA for what it sells and the Cybersecurity Act for its own operations, for example in the manufacturing sector. For organisations that only buy products, the CRA supports supplier work - CE-marked products with security updates make supply-chain requirements easier to meet.

08

How to get started

Five first steps for a manufacturer:

• Inventory which products have digital elements and which category they fall into.
• Have a routine for receiving and handling vulnerability reports - and for reporting within 24 hours.
• Produce a software bill of materials (SBOM) for each product.
• Decide the support period and how security updates are delivered.
• Run a gap analysis against the essential requirements in Annex I well before December 2027.