Cybersecurity & Resilience
Cyber Resilience Act: manufacturers prepare for new conformity requirements
Key takeaways
- CRA conformity follows the EU product-safety model: technical documentation, conformity-assessment modules and CE marking — extended by cyber lifecycle duties.
- Standard products can often reach market via self-assessment (Module A); important and critical products need notified bodies or certification schemes.
- Harmonised standards are still emerging — manufacturers should build Annex I evidence in parallel instead of waiting for publication.
- Product documentation covers risk assessment, SBOM, update strategy and support end — versioned and market-surveillance-ready.
- Importers and distributors share responsibility; OEM chains need clear RACI per sales channel.
The Cyber Resilience Act moves cybersecurity into product conformity — for manufacturers that means conformity assessment, notified bodies, product documentation and CE marking become operational core, not a legal footnote. Anyone placing products with digital elements on the EU market should prepare CRA conformity requirements in a structured way now.
This article explains duties for manufacturers, importers and accountable integrators. Not legal advice.
Conformity in the CRA context
The CRA is an EU Regulation — directly applicable without national transposition laws like NIS2. Conformity means: the product meets essential cybersecurity requirements (Annex I), the manufacturer runs the appropriate conformity assessment, issues an EU declaration of conformity and places the product on the market with CE marking — plus support, update and reporting duties.
Germany’s BSI stresses: there is no separate cyber label. CE marking will include cyber — with longer responsibility than classic product safety.
Product categories and assessment routes
Three levels shape practice:
| Category | Examples (excerpt) | Assessment |
|---|---|---|
| Standard | Many B2B and consumer products | mostly Module A (self-assessment) |
| Important (Annex III) | Password managers, firewalls | Class 1: often self-assessment with harmonised standard; else notified body |
| Critical (Annex IV) | Smartcards, smart-meter gateways | certification under EU scheme |
The November 2025 implementing act on technical descriptions for important and critical products clarifies categories — a starting point for portfolio analysis.
NLF modules — short overview
- Module A: internal production control — manufacturer self-assesses.
- Module B + C: type examination by notified body, series production to type.
- Module H: full quality assurance — body audits manufacturer QA system.
Notified bodies: secure capacity early
For class 2 important and critical products, third-party assessment is mandatory — unless a complete EU certification scheme applies. From 11 June 2026, member states must establish procedures to assess, designate and notify conformity assessment bodies; by 11 December 2026 sufficient Union capacity should exist.
In Germany the BSI is the central contact. Manufacturers should:
- clarify product classification early,
- send RFQs to notified bodies with realistic timelines,
- build parallel internal evidence — use waiting time, do not waste it.
See our piece on designation of conformity assessment bodies.
Product documentation: the technical file
The technical documentation is the backbone of conformity. Minimum practical content:
- product description and intended use,
- cybersecurity risk assessment with threat scenarios,
- architecture and interface documentation,
- SBOM and component provenance,
- test and verification evidence,
- update and support strategy including end date,
- logs of security-relevant changes.
All versioned — market surveillance asks for files, not slides. Those using CRA implementation guidelines already have an interpretation frame for grey areas.
CE marking and transparency
Manufacturers must inform users about:
- support end and update availability,
- security-relevant product information,
- contact for vulnerability reports.
Unlike “static” product safety, duties do not end at placement — active vulnerability handling and free security updates during support are mandatory. That changes contract and pricing models, especially for IoT and industrial gateways.
Manufacturer duties along the chain
Manufacturers carry primary responsibility. Importers and distributors verify that manufacturers ensured conformity and must not place non-compliant products. In OEM models clarify:
- who holds the declaration of conformity?
- who speaks to market surveillance?
- who reports to ENISA from September 2026?
White-label and platform ecosystems fail here without contractual RACI.
Harmonised standards — use the gap, do not stall
Horizontal CRA standards are expected Q3/Q4 2026; full coverage runs to 2027. Manufacturers waiting for norms lose to competitors with Annex I evidence. Sensible strategy:
- Annex I gap assessment now,
- internal conformity readiness review,
- align to standards once cited in the Official Journal,
- if needed interim route via notified body when self-assessment without standards is blocked.
Check synergies with EU Cybersecurity Act / EUCC where products already need high assurance.
Industry and software — different clocks
Machinery builders with long lifecycles must align support reality and spare-part strategy with CRA — see industrial CRA/NIS2 readiness. SaaS vendors clarify remote processing and versioning: when is an update a new product?
Manufacturer checklist before placement (2027)
Conformity module and notified body if needed defined.
Technical file complete and versioned.
SBOM process integrated in build pipeline.
ENISA reporting process tested (live from September 2026).
CE information and support end documented in product/UI.
Conclusion
CRA conformity requirements permanently link product law and cybersecurity: conformity assessment, notified bodies, product documentation and CE marking are operational duties for manufacturers — with reporting from 2026 and full application in 2027. Starting evidence, supply-chain RACI and notified-body capacity planning now avoids market-access risk — waiting means joining the queue.
Further reading: EU CRA for companies, Cyber resilience foundations. Hiring: Cybersecurity recruitment.
Source
German Federal Office for Information Security (BSI) — Cyber Resilience Act
FAQ
- ISO 27001 helps organisational control but does not replace product conformity assessment and CE logic. Map — do not equate.
- At latest when Annex III class 2 or Annex IV products apply — and generally before the end-2026 capacity crunch when many manufacturers seek slots together.
- Yes — profiles linking technical files, SDLC and conformity modules are scarce. We search outcome-oriented, including passive market coverage.