NIS2 READY
Do you develop software, mobile applications, or internet-connected devices? If so, the Cyber Resilience Act (CRA) – the EU regulation on the cybersecurity of digital products – may apply to you.
The CRA does not only affect large technology companies. Smaller businesses that develop and place software or other products with digital elements on the market may also have obligations under the regulation.
And importantly, some obligations have already been in effect since September 2026. Manufacturers must prepare for further requirements by December 2027.
1. What Is the CRA and How Does It Differ from NIS2?
The CRA is an EU regulation designed to ensure that digital products are secure when they are placed on the market and remain secure throughout their use.
Put simply, NIS2 focuses on the cybersecurity of organisations and their services, while the CRA focuses on the security of digital products themselves.
For example, if a company develops software and also provides services in a sector regulated under NIS2, both NIS2 and the CRA may apply. This depends on the company’s specific activities, products, and the conditions under which each regulation applies. Complying with one does not automatically mean complying with the other.
The CRA may apply to products such as:
- Software applications and separately distributed software components
- Network and communication devices
- Smart internet-connected devices
- Security software and other digital products
However, not all software automatically falls within the scope of the CRA. Purely cloud-based services, open-source software, and products regulated by other legislation require individual assessment. Standalone Software-as-a-Service (SaaS) offerings generally fall outside the scope of the CRA, although remote data processing necessary for a digital product to function may be considered part of that product.
The first question is therefore: Do we place products on the market that fall within the scope of the CRA?
2. What Obligations Does the CRA Introduce, and When?
There are two particularly important dates for manufacturers.
From 11 September 2026 – Vulnerability and Incident Reporting
Manufacturers are already required, under the conditions set out in the CRA, to report actively exploited vulnerabilities and severe incidents affecting the security of their products.
The reporting deadlines are short:
- Within 24 hours of becoming aware – an early warning
- Within 72 hours of becoming aware – a more detailed notification
- A final report within the applicable deadline, depending on the type of event
Reports are submitted through the CRA Single Reporting Platform, operated by the European Union Agency for Cybersecurity (ENISA).
These obligations also apply to relevant products placed on the market before December 2027.
From 11 December 2027 – Product Cybersecurity Requirements
Manufacturers will be required to ensure that their products meet the applicable cybersecurity requirements.
In practice, this includes, for example:
- Products free from known exploitable vulnerabilities when placed on the market, with a minimised attack surface
- Secure default settings and protection of access to data
- Security updates and remediation of identified vulnerabilities
- Documentation of software components used in the product
- Assessment of the product’s cybersecurity risks
Manufacturers must also define a security support period, generally at least five years unless the product’s expected lifetime is shorter.
Other obligations include technical documentation, the applicable conformity assessment procedure, an EU declaration of conformity, and CE marking.
Transitional provisions apply to the main requirements for products placed on the market before December 2027.
Violations of certain key requirements may result in administrative fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher.
However, microenterprises and small enterprises are not subject to administrative fines solely for failing to meet the 24-hour early warning deadline. This does not remove their obligation to report.
3. What Does This Mean in Practice?
Imagine a company that develops an application for its customers. The application uses third-party libraries, processes data, and receives regular updates.
One day, a vulnerability is discovered in a library used by the application.
The company needs to determine whether the vulnerability affects its product, which versions are affected, what the potential impact is, and how to fix it.
It must also assess whether the vulnerability triggers a reporting obligation under the CRA. Discovering a vulnerability does not automatically mean it must be reported.
Regular software scanning alone is therefore not enough. Manufacturers need visibility into their products, components, risks, and security measures.
The CRA also requires manufacturers to document software components, including through a Software Bill of Materials (SBOM) – an inventory of software components and their dependencies.
It is equally important to have a process for receiving and handling vulnerability reports and to provide security updates throughout the defined support period.
4. Where Should You Start Preparing for the CRA?
You do not need to launch a large-scale project immediately. Start by understanding what you already have in place and what is still missing.
We recommend five practical steps:
- Identify your digital products. Determine which products fall within the scope of the CRA and what role your organisation plays in relation to them.
- Assess the risks. Identify product threats and vulnerabilities and determine the necessary security measures.
- Map your software components. Identify the libraries and dependencies you use and establish how you will monitor their vulnerabilities.
- Establish vulnerability and incident management procedures. Define responsibilities, a contact point, remediation processes, and how reporting obligations will be assessed.
- Review documentation and conformity assessment requirements. Determine what you need to prepare before placing a product on the market under the CRA.
If you already have cybersecurity management processes in place, you may be able to reuse some of them when preparing for the CRA.
5. How Can Tazilla Help?
Tazilla does not currently cover all CRA requirements. However, its existing features can help manufacturers establish a foundation for a systematic approach to CRA preparation.
Digital Product Inventory
In the Risk Analysis module, you can register software solutions and information systems as assets, assign responsibilities, and manage their associated risks.
Additional product information, such as the product version, CRA category, or support period, can currently be recorded in the asset description.
Risk Analysis and Security Measures
Tazilla enables organisations to identify threats and risks, propose security measures, and monitor their implementation.
This information can serve as a useful starting point when assessing the cybersecurity risks of digital products.
Cybersecurity Event Records
You can record cybersecurity events, including when they were identified, how they were handled, which assets were affected, and what corrective measures were taken.
This can also be useful given the short reporting deadlines under the CRA. However, manufacturers must independently assess whether an event is reportable under the CRA.
Software Vulnerability Analysis
The Code Analysis module helps identify known vulnerabilities in software components and dependencies.
The results can support remediation planning and software security management.
Tazilla can therefore support product inventories, risk analysis, security measure management, and cybersecurity event documentation. However, it does not replace a complete CRA product assessment, the required technical documentation, or the conformity assessment process.
Conclusion: Start With What You Already Have
The CRA is not just another documentation requirement. It changes how manufacturers must approach the security of digital products – from initial design to security updates and vulnerability management.
If your company develops or supplies digital products, the first step is to determine whether the CRA applies to them, which obligations are already in effect, and what needs to be prepared by December 2027.
You do not have to start from scratch. What matters is understanding what you already have covered and what still needs to be addressed.