CRA

This Regulation lays down rules for making available products with digital elements, essential cybersecurity requirements for their design/development/production and for manufacturers' vulnerability handling processes, and rules on market surveillance and enforcement.

This Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a data connection to a device or network, with carve-outs for medical devices, vehicles, aviation-certified products, maritime equipment, spare parts, and national security/defence products.

Key definitions including product with digital elements, manufacturer, software bill of materials, vulnerability, actively exploited vulnerability, incident, conformity assessment, and CE marking.

Products with digital elements may only be made available on the market where they meet the essential cybersecurity requirements in Annex I Part I (properly installed/maintained/used as intended, with necessary security updates) and the manufacturer's processes meet Annex I Part II.

Manufacturers must design/develop/produce products in accordance with Annex I Part I; conduct and document a cybersecurity risk assessment; exercise due diligence integrating third-party/open-source components; report and remediate vulnerabilities in integrated components; maintain vulnerability handling (incl. SBOM per Part II point 1) for at least a 5-year support period; draw up technical documentation and carry out conformity assessment before placing on the market; and keep records, a single point of contact, and user instructions for at least 10 years.

Manufacturers must maintain a software bill of materials covering at least the top-level dependencies of the product, as part of the vulnerability-handling requirements for the support period.

Manufacturers must notify any actively exploited vulnerability and any severe incident affecting product security to the CSIRT designated as coordinator and ENISA, via the single reporting platform, within 24 hours (early warning), 72 hours (notification), and a final report within 14 days (vulnerability) or one month (incident).

The technical documentation must contain all relevant data/details (at least the elements in Annex VII) showing the product and manufacturer's processes comply with the essential cybersecurity requirements. It must be drawn up before the product is placed on the market and kept continuously updated during the support period.