Complass
Cyber Resilience Act for manufacturers of hardware and software
Friday evening: an actively exploited vulnerability in your own product. And the CRA reporting clock has been running since September 2026.
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) obliges manufacturers, importers and distributors of products with digital elements to meet cybersecurity requirements across the whole product lifecycle. Unlike NIS2, it targets not operators but those who place hardware and software with digital elements on the market – from machine builders with networked controllers to pure software vendors.
The whitepaper opens with a Friday-evening call about an actively exploited vulnerability, then explains the CRA obligations for manufacturers, importers and distributors from there: from the reporting obligation already running since 11 Sep 2026, to the full obligations (conformity assessment, CE marking) from 11 Dec 2027, including the Annex I product requirements and software bills of materials (SBOM), with practice examples for both hardware and software makers.
New in version 1.3: the status in November 2026 (reporting platform, Implementing Regulation (EU) 2025/2392 on the product categories, standards), the corrected reporting path via the single reporting platform and the new product liability.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot (decision W11); only features already live are named.
12 pages · Version 1.3 · as of · Author Marc Linden, Complass GmbH
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.