EU Cyber Resilience Act Essential Guide

What it is

The Applus Laboratories essential guide to the EU Cyber Resilience Act (CRA), a regulation for "products with digital elements" (PDEs) placed on the EU market. Beyond the summary's overview, the page's actionable core is which conformity route you can actually use today — which turns out to depend on whether harmonised standards exist yet, not just on product class.

How it works

A PDE is in scope if its use "foreseeably involves either a logical or a physical connection to a network or another device" — covering hardware, software, and associated remote data-processing solutions. Classification is the first step and determines the conformity assessment procedure. Essential requirements (Article 14) cover risk management, secure-by-default configuration, access control, secure data storage, and vulnerability handling/incident reporting, plus Technical Documentation as evidence of compliance.

The route by class:

• Default PDEs (most consumer devices, general software): self-assessment (Module A); third-party is optional.
• Important Class I (password managers, antivirus, routers, VPNs, browsers, OSes, secure chips; also smart home devices, smart toys, health/personal wearables): third-party assessment is the only available option until category standards are harmonised and cited in the EU Official Journal — only then does self-assessment become available.
• Important Class II (hypervisors and containers, firewalls including IDS/IPS, tamper-resistant microprocessors/microcontrollers): third-party conformity assessment required.
• Critical (hardware devices with security boxes, smart cards or similar, smart meter gateways).

flowchart TD
  A[PDE with network/device connection] --> B{Class?}
  B -->|Default| C[Self-assessment Module A]
  B -->|Important I| D{Harmonised standard<br/>cited in EUOJ?}
  D -->|No, current state| E[Third-party only]
  D -->|Yes| F[Self-assessment available]
  B -->|Important II| G[Third-party required]
  B -->|Critical| G

Preconditions / Affected

Manufacturers, importers, and distributors placing PDEs on the EU market. Per the Blue Guide, a new batch of an existing product must meet the new requirements even if the version is unchanged from before the deadline — a re-release resets the obligation. Reporting obligations (Article 69(3)) apply to all products, including those sold before 11 Dec 2027: from 11 Sept 2026, any product still on the market must have processes to detect and report vulnerabilities.

What to do

If your product falls in Important Class I, do not assume self-assessment is available — check whether a harmonised standard for your category has been cited in the EUOJ; if not, plan and budget for third-party assessment now. Consult the vendor's dedicated CRA timeline for Notified Body accreditation and standards-harmonisation milestones, since third-party routes cannot complete until Notified Bodies are designated.

Caveats

The page is a vendor explainer, not the regulation text; category standards are still "being developed," so the Class I route availability is a moving target. The Critical-class description is cut off mid-sentence in the fetched text.