The Cyber Resilience Act is product law for cybersecurity. It does not govern how a company protects its own IT, but which security properties hardware and software made available on the EU market must have and how manufacturers handle vulnerabilities.
What is covered
Products with digital elements, meaning hardware and software that can connect directly or indirectly to a device or network: connected devices, operating systems, desktop and mobile apps, firmware. Pure software as a service is generally not covered by the CRA but falls under NIS2. Remote data processing solutions without which a product cannot perform its functions are covered, such as the cloud backend of a device app.
Reporting duties since 11 September 2026
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products via ENISA’s Single Reporting Platform: an early warning within 24 hours, a more detailed notification within 72 hours and a final report within set periods. The duty can also cover products placed on the market before that date.
Obligations from December 2027
From 11 December 2027 the essential requirements apply: security by design and by default, vulnerability handling over a defined support period, security updates, a software bill of materials (SBOM), technical documentation, conformity assessment and CE marking. Certain important and critical products face stricter conformity assessment.
Relevance for Switzerland
A Swiss manufacturer selling connected devices or installable software in the EU is covered like an EU manufacturer. Anyone without an overview of the open-source components used, without a process for incoming vulnerability reports and without a defined support period should tackle these three points first. The reporting channels belong in one incident response plan together with those under the ISA and the FADP.