Complass
Cyber Resilience Act for manufacturers of hardware and software
Friday evening, an actively exploited vulnerability in your own product – and a reporting clock that has been running since September 2026. What the CRA requires from hardware and software makers.
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) obliges manufacturers, importers and distributors of products with digital elements to meet cybersecurity requirements across the whole product lifecycle. Unlike NIS2, it targets not operators but those who place hardware and software with digital elements on the market – from machine builders with networked controllers to pure software vendors.
The whitepaper opens with a Friday-evening call about an actively exploited vulnerability, then explains the CRA obligations for manufacturers, importers and distributors from there: from the reporting obligation already running since 11 Sep 2026, to the full obligations (conformity assessment, CE marking) from 11 Dec 2027, including the Annex I product requirements and software bills of materials (SBOM), with practice examples for both hardware and software makers.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot (decision W11); only features already live are named.
12 pages · Version 1.2 · as of 07.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.