available
Industry template: Manufacturers
- Cyber Resilience Act per product up to CE marking
- Radio Equipment Directive with EN 18031
- Vulnerability management with SBOM
from €427 per month plus VAT in the Start package, size S, annual payment
Who it’s for
Complass for manufacturers of software and connected devices
You develop software, firmware, apps or connected devices and sell them in the EU. Since 11 September 2026 you have to report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act, and from 11 December 2027 all requirements for your products apply. Complass guides you per product from classification to CE marking and through the support period.
The challenge
Reporting within 24 hours
For an actively exploited vulnerability you have 24 hours until the early warning, even for products that have been on the market for a long time. This only works with a well-rehearsed process.
Knowing what is in the product
Libraries, open source and supplier components: without an up-to-date software bill of materials you cannot tell which product is affected by a new vulnerability.
Several frameworks per product
The Radio Equipment Directive, the CRA, the Data Act and, where relevant, the AI Act interlock, each with its own deadlines and transitions.
What applies to your products
The Cyber Resilience Act applies to products with digital elements that can connect to a device or network, which covers most software and almost all connected devices. Exceptions include medical devices and vehicles with their own type approval.
Frameworks: CRA · Radio Equipment Directive · IEC 62443 for manufacturers · Data Act · AI Act
- Report actively exploited vulnerabilities and severe security incidents: early warning within 24 hours, notification within 72 hours, final report; since 11 September 2026, also for products already on the market Art. 14 CRAArticle 14 Cyber Resilience Act Reporting obligations of manufacturers1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16. 2. For the purposes of …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Handle vulnerabilities: software bill of materials in a common machine-readable format, security updates, regular testing and a contact point for external reports Annex I Part II CRAAnnex I Part II Cyber Resilience Act Vulnerability handling requirementsManufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products; (2) in relation to the risks posed to products with digital elements, address and remediate …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Set a support period that reflects the expected time of use, as a rule at least five years Art. 13(8) CRAArticle 13 Cyber Resilience Act Obligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- From 11 December 2027: cybersecurity requirements for the product, conformity assessment depending on the class, technical documentation, EU declaration of conformity and CE marking Annex I Part I CRAAnnex I Part I Cyber Resilience Act Cybersecurity requirements relating to the properties of products with digital elements(1) Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks. (2) On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall: - (a) be made available on the market without known exploitable vulnerabilities; - (b) be made available on …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗ Art. 28 CRAArticle 28 Cyber Resilience Act EU declaration of conformity1. The EU declaration of conformity shall be drawn up by manufacturers in accordance with Article 13(12) and state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated. 2. The EU declaration of conformity shall have the model structure set out in Annex V and shall contain the elements specified in the relevant conformity assessment procedures set out in …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Radio products with internet access already meet the cybersecurity requirements of the Radio Equipment Directive today, until the CRA replaces them on 11 December 2027 Art. 3(3) REDArticle 3 RED Essential requirements1. Radio equipment shall be constructed so as to ensure: - (a) the protection of health and safety of persons and of domestic animals and the protection of property, including the objectives with respect to safety requirements set out in Directive 2014/35/EU, but with no voltage limit applying; - (b) an adequate level of electromagnetic compatibility as set out in Directive 2014/30/EU. 2. Radio equipment shall be so …Open original (EUR-Lex – consolidated version of 30.05.2026) ↗ Delegated Regulation (EU) 2022/30Article 1 Delegated Regulation (EU) 2022/301. The essential requirement set out in Article 3(3), point (d), of Directive 2014/53/EU shall apply to any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment (‘internet-connected radio equipment’). 2. The essential requirement set out in Article 3(3), point (e), of Directive 2014/53/EU shall apply to any of the following radio equipment, if …Open original (EUR-Lex – consolidated version of 27.10.2023) ↗
- Connected products placed on the market since 12 September 2026 must make their data accessible to users Art. 3 Data ActArticle 3 Data Act Obligation to make product data and related service data accessible to the user1. Connected products shall be designed and manufactured, and related services shall be designed and provided, in such a manner that product data and related service data, including the relevant metadata necessary to interpret and use those data, are, by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, …Open original (EUR-Lex – OJ L 2023/2854, 22.12.2023 (language-specific corrigenda not incorporated)) ↗
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
AI in the product. If your product contains an AI system, check its classification under the AI Act. If the AI is a safety component of a product that needs a third-party conformity assessment under EU law, it may be high-risk. Transparency obligations, for example for chatbots, have applied since 2 August 2026. Art. 6 AI ActArticle 6 AI Act Classification rules for high-risk AI systems1. Irrespective of whether an AI system is placed on the market or put into service independently of the products referred to in points (a) and (b), that AI system shall be considered to be high-risk where both of the following conditions are fulfilled: - (a) the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation …Open original (EUR-Lex – consolidated version of 27.07.2026) ↗ Art. 50 AI ActArticle 50 AI Act Transparency obligations for providers and deployers of certain AI systems1. Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This …Open original (EUR-Lex – consolidated version of 27.07.2026) ↗
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Typical companies
Software vendors Focus area
Standard software, apps and firmware: software bill of materials, updates and notifications throughout the support period.
Manufacturers of connected devices
Smart home, IoT and industrial devices with radio: the Radio Equipment Directive today, the CRA from December 2027.
Components for industrial automation
Controllers, gateways and network components; routers and other network components partly count as important products with a stricter conformity procedure. IEC 62443-4-1 and 4-2 are a widely used framework.
Providers with AI features
Products with embedded AI: classification under the AI Act in addition to the CRA.
How Complass helps
CRA per product
Classification, risk assessment, Annex I requirements, technical documentation and declaration of conformity, guided in phases.
More about this featureSBOM and vulnerabilities
Import software bills of materials (CycloneDX, SPDX), match vulnerabilities and vendor advisories (CSAF) and export SBOM and VEX for customers and authorities.
More about this featureCRA notifications with countdown
Actively exploited vulnerability or severe incident: Complass shows the three reporting stages with deadline and the required details.
More about this featureSecure development under IEC 62443-4
A framework of its own for manufacturers with templates for the development process, the threat model and the PSIRT process, linked with the CRA.
Matching offers
The Manufacturers industry template preselects the CRA, the Radio Equipment Directive and vulnerability management with SBOM. You add the AI Act if you need it.
available
Framework AI Act
- Record and classify AI systems
- Implement and evidence obligations as provider or deployer
from €79 per month plus VAT in the Practice package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Frequently asked questions
Does the CRA also apply to pure software?
Yes. Software sold on its own is also a product with digital elements. Pure cloud services without a product link usually fall under NIS2 rather than the CRA. Remote data processing without which a product cannot perform its function, however, is part of the product.
What do we have to do since 11 September 2026?
You have to report actively exploited vulnerabilities and severe security incidents via the single reporting platform, with an early warning within 24 hours. This also applies to products you placed on the market before this date.
Do we need IEC 62443 if we implement the CRA?
The series of standards is not mandatory but is often required for industrial components. IEC 62443-4-1 describes requirements for a secure development process, IEC 62443-4-2 technical security requirements for components. Complass links both with the CRA requirements.
Read on
Further reading
Cyber Resilience Act für Hersteller von Hardware und Software
View white paperSecure Development für Hersteller
View white paperFunkanlagenrichtlinie: Cybersicherheit für vernetzte Funkanlagen bis zum CRA
View white paperAsset-Inventar, SBOM und Schwachstellenmanagement: wissen, was läuft, und belegen, was Sie tun
View white paperGuide
Other sectors and roles
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.