The CRA applies to manufacturers, importers and distributors of products with digital elements on the EU market, regardless of origin. Vulnerability and incident reporting obligations have applied since 11 September 2026; the remaining requirements apply from 11 December 2027. Fines reach up to €15m or 2.5% of global turnover.
Product security is becoming a strategic business responsibility, not only an engineering matter. Compliance touches product management, development, procurement, legal and customer support, and requires security to be built in and maintained throughout the product’s support period.
