The Cyber Resilience Act for SMBs: does it reach your products?
Selling software or connected products under your brand? See what changes, and what applies already.
Does it apply to you?
Three questions to check in two minutes.
Yes to the first two: the law probably treats you as the "manufacturer". The exact tests are in the section for your IT manager, below.
- Do you sell a product with software or a connection?Hardware or software that connects to a device or a network: a machine with a controller, an app, a smart device. Software sold purely as an online service is generally out.
- Is it sold under your name or brand?Even if someone else makes it for you. Importers and distributors who put their own brand on a product count too, as does anyone who substantially changes one.
- Are any of these products already on sale?The reporting duty already covers products sold before the law, including ones from years ago.
Not in scope?
Only importing or reselling? You still have checks to make.
From 11 December 2027, importers and distributors must check that what they sell carries the CE marking and comes with the required information. A product you only use in your own business creates no duty under this law.
What changes for you
Security becomes part of the CE marking.
From 11 December 2027, a product with software or a connection must meet EU security requirements before it carries the CE marking and goes on sale in the EU. In short: no known exploitable flaws at release, secure default settings, and free security updates for as long as the product is expected to be used, normally at least five years.
One part applies already. Since 11 September 2026, if you learn that a flaw in one of your products is being actively exploited, you must send a first alert within 24 hours. That includes products sold years ago.
The real risk is market access: no conformity means no CE marking and no EU sales, and your business customers will ask for proof before any authority does. The fix starts with knowing which products are in scope and how they are classified, because that sets the cost.
What to do first
Know which products are in scope, then get ready to report.
What we deliver
- A written answer, product by product: in scope or not, and in which class
- A reporting plan for the 24-hour alert, with a named person and a rehearsal
- Your gaps against the security requirements, ranked, with what engineering must change
- Policies for updates, vulnerability reports and the components you build on
- The documentation and conformity route behind your CE marking
Who does what
We lead the compliance work. Your product team keeps the engineering.
What we lead
- Work out which products are in scope, and their class
- Set up the reporting chain and rehearse it
- Rank the gaps and set the plan
- Write the update, disclosure and support-period policies
- Prepare the technical file and the conformity route
What stays with your product team
- Fix security flaws in the product
- Build and ship the security updates
- Keep the list of software components up to date
We review their work against the requirements, so the evidence holds up. We do not change code or firmware.
How it starts
Your first step: the CRA Scope Opinion.
In 2 weeks you have a written answer: whether you are a manufacturer, which products are in scope, and their class. The fee is deducted if you continue with us within 6 months.
- From
- €3,500excl. VAT
- Duration
- 2 weeks
- Your time
- Two 1-hour meetings, plus documents
Fixed price, set by the number of product lines.
book a free 25-minute consultationFor your IT manager, DPO or CFO
What the regulation requires, by article.
Which of these bind you, and how hard, is settled in Phase 1 by your role and your product classification. These are the ones that land on an SMB manufacturer.
- 01Art. 13(2) · Annex I Part I
Risk assessment and product properties
A documented risk assessment per product, kept current across the support period, and thirteen essential properties applied on its basis — among them no known exploitable vulnerabilities at release, secure-by-default configuration, security updates, access control, confidentiality and integrity protection, and secure data deletion.
- 02Annex I Part II · Art. 13(5)
Vulnerability handling and third-party components
A software bill of materials covering at least top-level dependencies, remediation without undue delay, regular testing, public disclosure of fixed vulnerabilities, a coordinated vulnerability disclosure policy, a reporting contact, and free secure updates — plus due diligence on the components you integrate, open-source included.
- 03Art. 13(8), (9), (19) · Annex II
Support period — at least five years
Set a period reflecting how long the product is realistically in use; the floor is five years. Updates issued during it stay available a further 10 years. Its end-date, month and year, must be stated at the point of purchase, alongside the vulnerability reporting contact and secure commissioning instructions.
- 04Art. 14
Reporting — 24 hours, 72 hours, 14 days
For an actively exploited vulnerability or a severe incident: early warning within 24 hours of becoming aware, full notification within 72 hours, final report within 14 days of a fix being available — one month for incidents. Filed once, via the ENISA single reporting platform.
- 05Art. 7 · Annex III
Important products — class I and class II
Products whose core functionality matches an Annex III category. Class I spans identity and access management, browsers, password managers, anti-malware, VPNs, SIEM, PKI, operating systems, routers and smart-home security products; class II covers hypervisors and container runtimes, firewalls and IDS/IPS, and tamper-resistant chips.
- 06Art. 32 · 13(13) · Annex VII
Conformity assessment, CE marking and documentation
Default products may self-assess under internal control (module A). Class I loses that option where harmonised standards or an equivalent scheme have not been applied; class II always needs a notified body or a European certification scheme at assurance level at least substantial, and Annex IV critical products sit above that again. Technical documentation is kept 10 years, or the support period if longer. Classification is the decision that sets your budget.
Article 64: three bands, and a derogation narrower than it looks.
CRA fines are administrative, set by national market surveillance authorities, and calculated as the higher of a fixed amount or a share of worldwide annual turnover. Breaching the Annex I requirements or the Article 13 and 14 obligations sits in the top band; most other obligations in the middle; misleading information to a notified body or authority at the bottom.
The relief for the smallest firms is narrower than it looks. Article 64(10)(a) removes the fine for microenterprises and small enterprises — under 50 staff, and turnover or balance sheet of €10M or less — for missing the deadline in Article 14(2)(a) or 14(4)(a): the 24-hour early warning, and only that. Not the 72-hour notification, not the final report, not the duty to report. The fine is rarely the first consequence anyway — market access does not wait: no conformity, no CE mark, no EU market, and a NIS2-covered customer running Article 21(2)(d) due diligence will ask for your CRA position long before a regulator does.
Annex I, Art. 13 & 14
€15M / 2.5%
whichever is higher, of total worldwide annual turnover.
Other obligations
€10M / 2%
Articles 18–23, 28, 30, 31, 32, 33(5), 39, 41, 47, 49 and 53.
Incorrect information
€5M / 1%
to notified bodies and market surveillance authorities, in reply to a request.
Typical timeline
Reporting is already live, so scope determination is urgent and the rest is a 2027 programme. Gap analysis, remediation and a documentation build run six to nine months — so to be ready for 11 December 2027, start by early 2027 at the latest.
1–2 weeks
Scope & classification
Manufacturer determination per product line, inventory, Annex III classification, and a Service Profile scoping the rest. This phase either ends the engagement or changes the conversation entirely.
Immediate
Reporting readiness
The one obligation already in force. Decision chain, named filer and deputy, EU Login account, CSIRT determination under Article 14(7), and a live-fire rehearsal.
Following scoping
Annex I gap analysis
Parts I and II assessed per product, with a roadmap separating what engineering must build from what governance can close.
Pre-December 2027
Documentation & conformity
Technical documentation, support-period reasoning, user information pack, conformity route, and the sign-off that makes the declaration of conformity defensible.
FAQ