Does the Cyber Resilience Act apply to UK companies?
The EU Cyber Resilience Act, Regulation (EU) 2024/2847, concerns products with digital elements made available on the EU market. Being based in the UK does not, by itself, put a supplier outside its reach. Connected devices and software components sold separately can both be relevant. See the Commission’s scope summary.
Check what you supply, how it connects to other devices or networks, who markets it and whether an exclusion applies. Establish your role as manufacturer, importer or distributor rather than assuming the same duties apply to everyone.
Automotive scope needs care. Article 2 excludes products to which Regulation (EU) 2019/2144 applies. Do not assume that every vehicle-related app, tool or accessory is covered by that exclusion. Confirm the product boundary against the CRA legal text and the vehicle approval framework.
Cyber Resilience Act deadlines: what applies when?
| Date | What it means |
|---|---|
| 10 December 2024 | The CRA entered into force. |
| 11 September 2026 | Manufacturer reporting duties under Article 14 began applying. |
| 11 December 2027 | The main product security obligations apply. |
These dates come from the European Commission’s CRA overview. The transitional rules matter for existing products: Article 69 generally treats products placed on the market before 11 December 2027 differently unless subsequently substantially modified, while Article 14 reporting also reaches in-scope products placed on the market earlier. Check the transition provisions for your portfolio.
Reporting is already a current obligation
For manufacturers, Article 14 covers actively exploited vulnerabilities contained in the product and severe incidents affecting its security. The early warning is due within 24 hours of awareness, followed by a notification within 72 hours. Reporting uses the CRA Single Reporting Platform.
The final-report deadlines differ: for an actively exploited vulnerability, no later than 14 days after a corrective or mitigating measure is available; for a severe incident, within one month of the 72-hour notification. See the Commission’s reporting guidance for the triggers and required information.
Practically, decide who receives reports, who determines whether reporting is required, who can submit and how engineering evidence reaches them. Rehearse that handover before a live issue forces the decision.
What should manufacturers prepare for 2027?
The Commission’s manufacturer guidance describes a lifecycle approach: assess cyber risk, implement the relevant essential requirements, document the result and follow the applicable conformity assessment route. Product information, the EU declaration of conformity and CE marking form part of that process.
Manufacturers also need to plan vulnerability handling during the support period. The CRA generally sets a minimum of five years, with a shorter period where expected product use is shorter; expected use can also require longer support. Check Article 13 in the Regulation when setting your support policy.
For an engineering team, useful preparation includes:
- Map the shipped product. Record the hardware, firmware, software components and supporting services that deliver its functions. Keep the inventory tied to release versions.
- Review attack paths. Consider physical access, wireless interfaces, remote services, companion apps, manufacturing credentials and administrative functions.
- Check the update path. Test how the device authenticates an update, handles an interrupted installation and recovers to a usable state.
- Assign maintenance ownership. Establish who reviews component vulnerabilities, develops fixes and communicates with product users.
- Connect evidence to decisions. Record why a control was selected, what was tested and how failures were resolved.
How product security testing supports CRA readiness
A documented design claim becomes more useful when your team can demonstrate it on a production-representative device. If a gateway is described as accepting only signed firmware, test that claim across its normal updater, recovery mode and accessible maintenance interfaces.
Rootworks can assess the technical implementation across device hardware and firmware, embedded platforms and the applications around them. Agree the test objectives against your risk assessment, identify exploitable gaps and obtain evidence that engineering teams can use to prioritise remediation.
Prepare a representative device or build, architecture notes, firmware versions, known constraints and the requirements you want to verify. That makes it possible to scope useful work without treating a generic vulnerability scan as the complete assessment.
Cyber Resilience Act questions
Is the CRA the same as the UK Cyber Security and Resilience Bill?
No. The CRA is EU product legislation. The UK Bill concerns reform of the UK network and information systems regime. They have different scopes and timelines. See our overview of the relevant requirements.
Does every product need third-party certification?
The conformity assessment route depends on the product classification and applicable conditions. Some products require assessment by a notified body. Confirm the route for your product using the Commission’s CRA guidance; a security testing report alone does not replace it.
Should we wait until December 2027 to begin?
Reporting duties already apply. For the broader engineering work, updating device architecture, supplier arrangements and long-lived firmware can take time. Prioritise gaps that affect release plans and the ability to maintain products already deployed.
Official sources
- European Commission: CRA overview and dates
- European Commission: scope and obligations summary
- European Commission: reporting obligations
- European Commission: manufacturer obligations
- Regulation (EU) 2024/2847: Articles 2, 13, 14, 69 and 71
Technical guidance, not legal advice. Confirm legal scope and obligations with your compliance or legal adviser. Requirements and guidance can change; check the linked official sources for updates.