Important Legal Notice: This website does not replace official EU publications
We are not responsible for discrepancies with official sources. Always consult the official publications for legal compliance and authoritative information.
Regulation (EU) 2024/2847
CRAWhat manufacturers, importers, distributors and open-source software stewards must do under the Cyber Resilience Act, chapter by chapter and article by article, with the essential cybersecurity requirements of Annex I that the obligations of manufacturers point to (Art. 13(1)).
At a glance
Chapter by chapter, each article that puts an obligation on someone, with who it addresses and what it asks. The wording here is a summary; the article text is the law, and it is one click away.
Chapter I · Art. 1 to 12
Who. All economic operators (manufacturers, importers, distributors) placing products with digital elements on the EU market
Who. All products with digital elements (hardware or software) that have direct or indirect data connections to devices or networks, when made available on the EU market, except for specifically excluded categories
Who. All economic operators involved in developing, manufacturing, importing, or distributing products with digital elements in the EU market, including manufacturers, open-source software stewards, authorized representatives, importers, and distributors
Who. Member States, manufacturers, distributors, and anyone presenting or testing products with digital elements in the EU market
Who. Member States when procuring or regulating the use of products with digital elements, particularly for national security, defense, or public procurement purposes
Who. Manufacturers and distributors of any products with digital elements being placed on the EU market
Who. Manufacturers and developers of products with digital elements that perform critical cybersecurity functions (authentication, intrusion detection, endpoint security, network protection) or have significant control over other systems, networks, or user safety
Who. Manufacturers of critical products with digital elements that have core functionality listed in Annex IV (specific critical product categories defined by the Commission)
Who. The European Commission when implementing the CRA
Who. Member States (EU countries), with potential support from the European Commission, European Cybersecurity Competence Centre, and ENISA
Who. Manufacturers, importers, and distributors of products with digital elements where safety aspects fall outside CRA scope and lack specific EU harmonization legislation
Who. Manufacturers of products with digital elements that are classified as high-risk AI systems under the AI Act
Chapter II · Art. 13 to 26
Who. Manufacturers of products with digital elements (hardware or software products that connect to devices or networks) when placing products on the EU market
and 10 more in the full text
Who. Manufacturers of products with digital elements placed on the EU market
and 3 more in the full text
Who. Manufacturers and any other natural or legal persons who discover vulnerabilities, cyber threats, security incidents, or near misses affecting products with digital elements
Who. ENISA, member state CSIRTs (Computer Security Incident Response Teams), manufacturers reporting vulnerabilities/incidents, and market surveillance authorities
Who. ENISA, CSIRTs, manufacturers reporting incidents, and indirectly all manufacturers of products with digital elements
Who. Manufacturers (optional - they may choose to appoint a representative) and authorized representatives acting on behalf of manufacturers
Who. Entities that import products with digital elements into the EU market from third countries
and 4 more in the full text
Who. Distributors of products with digital elements (companies that make products available on the market but don't manufacture or import them)
and 3 more in the full text
Who. Importers and distributors who either rebrand products with digital elements under their own name/trademark or make substantial modifications to already-marketed products
Who. Any person or company (other than manufacturers, importers, or distributors) who substantially modifies digital products and makes them available on the market
Who. All economic operators (manufacturers, importers, distributors, or any business entity) involved in the supply chain of products with digital elements
Who. General applicability
Who. Developers and users of free and open-source software, third parties performing assessments, and manufacturers integrating open-source components into products with digital elements
Who. European Commission (obligation to provide guidance) and indirectly all economic operators who will benefit from the guidance
and 2 more in the full text
Chapter III · Art. 27 to 34
Who. Manufacturers of products with digital elements seeking to demonstrate compliance with CRA cybersecurity requirements
Who. Manufacturers of products with digital elements placing or making products available on the EU market
Who. Manufacturers of products with digital elements that fall under the CRA scope and require CE marking
Who. Manufacturers and authorized representatives of products with digital elements (hardware and software) placing products on the EU market
Who. Manufacturers of products with digital elements covered by the Cyber Resilience Act
Who. All manufacturers of products with digital elements, with different requirements based on product classification (standard, Class I important, Class II important, or critical)
Who. Microenterprises, small and medium-sized enterprises (SMEs), including startups, as well as Member States and the European Commission who must provide support measures
and 1 more in the full text
Who. EU institutions negotiating trade agreements; indirectly benefits manufacturers and importers trading between the EU and countries with mutual recognition agreements
Chapter IV · Art. 35 to 51
Who. Member States (EU countries) and their designated authorities responsible for product conformity assessments
Who. EU Member States and their designated notifying authorities responsible for overseeing conformity assessment bodies
Who. EU Member State notifying authorities responsible for designating and monitoring conformity assessment bodies under the CRA
Who. Member States (EU countries) and the European Commission
Who. Conformity assessment bodies seeking notification to certify products under the Cyber Resilience Act
and 4 more in the full text
Who. Conformity assessment bodies seeking to become notified bodies for CRA product certification
Who. Notified bodies performing conformity assessments under the CRA
Who. Conformity assessment bodies seeking to become notified bodies under the CRA
Who. EU member state notifying authorities and conformity assessment bodies seeking to become notified bodies under the CRA
Who. European Commission and notified bodies (conformity assessment organizations)
Who. Notifying authorities (government bodies that authorize certification bodies) and Member States responsible for oversight of notified bodies under the CRA
Who. European Commission, notifying Member States, and notified bodies conducting conformity assessments under the CRA
Who. Notified bodies (third-party organizations authorized to assess product compliance) and indirectly affects manufacturers who must work with these bodies
Who. Member States (EU countries) who must implement the appeal system, and indirectly affects all entities subject to notified body assessments under the CRA
Who. Notified bodies performing conformity assessments under the Cyber Resilience Act
Who. European Commission and Member State national authorities responsible for notification policy
Who. European Commission, EU Member States, and all notified bodies involved in CRA conformity assessments
Chapter V · Art. 52 to 60
Who. Member State governments (must establish authorities), market surveillance authorities (enforcement duties), manufacturers and open-source software stewards (subject to surveillance), and consumers (who can report issues)
and 2 more in the full text
Who. Economic operators (manufacturers, importers, distributors) of products with digital elements subject to the Cyber Resilience Act
Who. Market surveillance authorities in EU Member States, economic operators (manufacturers, importers, distributors) of products with digital elements, notified bodies, and CSIRTs
and 1 more in the full text
Who. EU Member States, the European Commission, and economic operators whose products are subject to national safeguard measures
Who. Economic operators (manufacturers, importers, distributors) of products with digital elements, market surveillance authorities, and Member States
Who. Market surveillance authorities, manufacturers, economic operators placing products on the EU market, the European Commission, and ENISA
Who. Manufacturers of products with digital elements placed on the EU market
Who. Market surveillance authorities, the European Commission, ENISA, and indirectly affects manufacturers and distributors of digital products being investigated
Who. Market surveillance authorities, ENISA, European Commission, and indirectly all manufacturers/distributors whose products may be subject to sweeps
Chapter VI · Art. 61 to 62
Who. European Commission when creating delegated acts, European Parliament and Council for oversight and objection rights
Who. The European Commission and member state representatives on the CRA committee
Chapter VII · Art. 63 to 65
Who. All parties involved in CRA application including market surveillance authorities, the European Commission, Member States, notified bodies, manufacturers, importers, distributors, and any entity handling confidential information during CRA compliance
Who. All economic operators subject to the CRA (manufacturers, importers, distributors), with special consideration for microenterprises, SMEs, and exemptions for open-source software stewards
Who. Economic operators (manufacturers, importers, distributors) whose CRA violations harm or may harm collective consumer interests
Chapter VIII · Art. 66 to 71
Who. Market surveillance authorities, manufacturers, importers, and distributors of products with digital elements covered by the CRA
Who. Manufacturers and type-approval authorities for motorcycles, mopeds, tricycles, quadricycles, and other L-category vehicles covered by Regulation (EU) No 168/2013
Who. Manufacturers and distributors of products with digital elements that were placed on the market before the CRA takes effect
Who. European Commission (reporting obligations), European Parliament and Council (report recipients), ENISA and CSIRTs network (consultation participants)
Who. All manufacturers, importers, and distributors of products with digital elements within the EU market
Annex I
Manufacturers design, develop and produce products with digital elements in accordance with the essential cybersecurity requirements of Annex I (Art. 13(1)). Part I sets the requirements relating to the properties of the product; Part II the vulnerability handling requirements.
Crosswalk lists the Cyber Resilience Act next to the other laws: each requirement with its article, evidence and owner.
EU cybersecurity laws can be complex. Our free tools and guides work great for most people, but if you're dealing with something particularly challenging or have tight deadlines, we're here to help.
