CRA facts

Short answers to the questions makers actually ask, with the Article beside every claim. 26 pages, all citing Facts v2026.09.4.

Reporting starts

11 September 2026

Full application

11 December 2027

Open questions

Status page

All pages

What are the alternatives to CRACheck for Cyber Resilience Act compliance?
CRACheck, CRA Toolkit and OpenRegulatory Formwork all address Cyber Resilience Act compliance. CEMarque's difference is a deterministic, citation-first checker with permanent public verdicts — the fastest comparison is running your own product through it, free.
Does the EU Cyber Resilience Act apply to my mobile app?
Yes, in almost every case. An installed app that connects to anything is a product with digital elements, and publishing it in an EU app store makes it available on the EU market.
Does the CRA apply to browser extensions?
Yes, if it is monetised. An extension is installed software that connects to a network. The class question matters here: browsers are listed as important products, and extensions are not the browser.
What must I do by 11 December 2027?
Everything else. From full application a product placed on the EU market needs a completed technical file, an EU declaration of conformity you sign, CE marking, a stated support period and a software bill of materials.
What must I do by 11 September 2026?
Be able to report. From that date manufacturers must notify actively exploited vulnerabilities and severe incidents through the ENISA platform, with an early warning within 24 hours of becoming aware.
Where does the CE marking go on a software product?
Software gets CE marked on the declaration of conformity or on the website accompanying the product — not in the app. The marking is the last step of a process, not a badge you add.
Does the CRA require a coordinated vulnerability disclosure policy?
Yes. Every manufacturer must have a coordinated vulnerability disclosure policy in place, a contact address for reports, a single point of contact for users, and a practice of publishing fixed vulnerabilities.
What are the fines and penalties under the Cyber Resilience Act?
Fines reach EUR 15 million or 2.5% of worldwide annual turnover for breaching the essential requirements or the core manufacturer obligations, and market surveillance authorities can order withdrawal or recall.
Do I need a software bill of materials under the CRA?
Yes. Drawing up a software bill of materials in a commonly used, machine-readable format, covering at least the top-level dependencies, is part of the vulnerability-handling requirements every manufacturer must meet.
What are the CRA rules on security updates?
Security updates must be free, timely, securely distributed and accompanied by advisories; consumer products install them automatically by default with an easy opt-out; and the duty runs for the whole declared support period.
How long is the support period under the CRA?
You set the support period yourself, but it has a floor: it must reflect the time the product is expected to be in use, and at least five years unless the product is expected to be used for less.
What goes in the CRA technical file?
A technical file in the Annex VII structure — product description, design and vulnerability-handling documentation, risk assessment, SBOM, test reports — drawn up before market placement and kept for ten years or the support period.
Is my product a critical product under Annex IV of the CRA?
Critical products are the three Annex IV categories — hardware devices with security boxes, smart meter gateways, and smartcards or similar secure elements. Almost no software product is on this list.
Does my product need third-party assessment under the CRA?
Most products, no — default products self-assess under Module A. A notified body enters only for important class I products not applying standards in full, for class II, and for critical products without a certification scheme.
What goes in a CRA declaration of conformity?
A one-document statement, in the Annex V structure, in which the manufacturer takes sole responsibility that the product meets the essential requirements. A simplified web-linked form exists, and it travels with the product's paperwork for a decade or more.
Does the CRA apply to free or ad-supported apps?
Charging nothing does not put you outside the Regulation. What matters is whether the product is supplied in the course of a commercial activity, and advertising, data and freemium funnels all count.
Does the CRA apply to games?
Yes for a commercially published game with any online component. The awkward parts for studios are the support period, automatic security updates for consumer products, and games that are already shipped.
Is my product an important product class I under the CRA?
Class I is the first tier of "important" products — 19 categories including password managers, VPNs, browsers and smart home assistants — and it changes which conformity route you may use, not whether you are in scope.
Is my product an important product class II under the CRA?
Class II is the higher "important" tier — hypervisors, firewalls, tamper-resistant microprocessors and similar security-critical categories — and it removes self-assessment entirely: a notified body or certification scheme is mandatory.
What are importer and distributor obligations under the CRA?
Importers verify conformity before placing a product on the EU market and add their own identification; distributors check the paperwork exists and act with due care. Rebranding a product under your own name makes you its manufacturer.
Does the CRA apply to non-EU manufacturers?
Yes. The Regulation follows the product, not the company: making a product available on the EU market commercially puts you in scope wherever you are, with an authorised representative anchoring the paperwork inside the Union.
Does the CRA apply to open-source software I maintain?
Unmonetised open source is not placed on the market and is outside the Regulation. Stewards who systematically support commercial-use projects have a lighter regime. Companies that integrate your code are manufacturers of their products.
What is a product with digital elements under the CRA?
A software or hardware product and its remote data processing solutions, including components placed on the market separately. The phrase is broad on purpose and the remote-processing half is the part people miss.
Does the CRA apply to products placed on the market before December 2027?
Partly. Products placed on the market before full application need conformity only if substantially modified after it — but the Article 14 reporting duty applies to them regardless, and ordinary software updates can cross the modification line.
Is SaaS in scope of the CRA?
A pure cloud service is generally outside the CRA and falls under NIS2 instead. But a backend your own installed product cannot function without is part of that product, and is in scope with it.
Does the CRA apply to WordPress plugins and themes?
A paid or freemium plugin is a product with digital elements and is in scope. A genuinely non-monetised free plugin is not. Agencies that ship client sites under their own name are manufacturers of what they ship.

Everyone

Browser extensions

Desktop apps

Does the CRA apply to free or ad-supported apps?

Developer tools

Does the CRA apply to open-source software I maintain?

Games

hardware

Mobile apps

Plugins and themes

SDKs and libraries

Does the CRA apply to open-source software I maintain?

software

Web apps with an installed component

Is SaaS in scope of the CRA?

CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.