The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets mandatory cybersecurity requirements for products with digital elements — connectable hardware and software — placed on the European Union market. It entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027 (Source: digital-strategy.ec.europa.eu).
Provenance note: this page is built from the European Commission's own policy and implementation pages, not from the text of the regulation.
Raw Sources/holds no copy of Regulation (EU) 2024/2847 (CELEX 32024R2847); citations should upgrade to the primary text once it is ingested, and section-level provisions should be verified against it.
The Act reaches AI systems by product category rather than by naming them. Software placed on the EU market is a product with digital elements, so an AI product distributed in the Union falls within scope alongside the AI-specific obligations of the AI Act. Inside My AI Law & Policy Class 21: Understanding How the EU Regulates AI (Farahany, November 2025) uses this overlap as its worked example: a single AI diagnostic tool triggers at least eight EU-level frameworks at once, of which the CRA is the security-by-default layer. Regulating Under Uncertainty: Governance Options for Generative AI (G'sell, 2024) treats it in the same group of surrounding EU instruments alongside the Product Liability Directive and the withdrawn AI Liability Directive. The Commission's September 2022 AI Liability Directive proposal itself named the CRA proposal (COM(2022) 454) as complementary, describing both as aimed at increasing trust in products with digital elements (Proposal for an AI Liability Directive, COM(2022) 496 — Source Summary).
Obligations on manufacturers
The CRA introduces cybersecurity requirements covering the planning, design, development and maintenance of products with digital elements, and states that these obligations must be met at every stage of the value chain. Manufacturers must handle vulnerabilities across the product lifecycle rather than at the point of sale alone. Products bear the CE marking to indicate conformity, and national market surveillance authorities enforce. Some products of particular cybersecurity relevance require third-party assessment by a notified body before being placed on the EU market (Source: digital-strategy.ec.europa.eu).
The regulation takes a distinct approach to free and open-source software, which the Commission attributes to that software's central role in the supply chain (Source: digital-strategy.ec.europa.eu). The Commission published practical implementation guidance on 27 July 2026 (Source: digital-strategy.ec.europa.eu).
Reporting obligations from 11 September 2026
From 11 September 2026 manufacturers must notify actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements. The notification runs on a three-stage clock: an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available for an actively exploited vulnerability, or within one month for a severe incident (Source: digital-strategy.ec.europa.eu).
Manufacturers report once, through the CRA Single Reporting Platform. The notification is addressed to the Computer Security Incident Response Team of the manufacturer's main establishment and, absent exceptional circumstances, is made available simultaneously to ENISA; the receiving CSIRT shares it without delay with the CSIRTs of every territory in which the product has been made available. A delegated act adopted on 11 December 2025 (CELEX 32026R0881) specifies the terms on which a CSIRT may delay that dissemination on justified cybersecurity grounds (Source: digital-strategy.ec.europa.eu; eur-lex.europa.eu).
Article 16 tasks ENISA with establishing the platform. ENISA ran a public tender and procured contractor services for its development; the Commission stated in a page last updated 31 July 2026 that the platform will be operational by 11 September 2026 and that functional and security testing were under way (Source: digital-strategy.ec.europa.eu).
Position among EU reporting duties
The September 2026 date is what brings the CRA into the AI incident-reporting picture. AI Incident Reporting records that from that date an AI-related incident in the EU can trigger four reporting duties at once, on different clocks and against different regulated entities: the CRA layered over the NIS2 Directive, the General Data Protection Regulation and Medical Device Regulation vigilance. The CRA's own framing places it as complementary to NIS2 and as building on the 2020 EU Cybersecurity Strategy and EU Security Union Strategy (Source: digital-strategy.ec.europa.eu).
The regulated entity differs across those layers, which is the practical source of the overlap: the CRA addresses the manufacturer of a product with digital elements, NIS2 addresses essential and important entities operating services, and the GDPR addresses controllers and processors of personal data. A single AI product can occupy more than one of those roles at once.
Open questions
- How the CRA's actively-exploited-vulnerability trigger applies to a model rather than to conventional software — whether, for instance, a jailbreak or a capability elicited through an agentic harness constitutes an exploited vulnerability in a product with digital elements.
- How the CRA's manufacturer duties interact with the AI Act's provider and deployer obligations where the same entity holds both roles.
- Whether the Single Reporting Platform is in fact operational on 11 September 2026; the Commission's statement of 31 July 2026 records testing under way rather than completion.
Relationships
- related: EU AI Act (Regulation 2024/1689) — the AI-specific regime the CRA sits alongside for software products.
- supports: AI Incident Reporting — supplies the fourth EU reporting layer and its clocks.
- related: AI and Cybersecurity — the broader policy area.
- related: Digital Markets Act (EU) — another of the horizontal EU digital instruments an AI product may trigger at once.
- depends-on: Inside My AI Law & Policy Class 21: Understanding How the EU Regulates AI (Farahany, November 2025) — the account of the EU regulatory architecture this instrument sits in.
- related: Regulating Under Uncertainty: Governance Options for Generative AI (G'sell, 2024) — treats the CRA among the surrounding EU instruments applicable to AI.
- related: EU AI Liability Directive (proposed, withdrawn), Proposal for an AI Liability Directive, COM(2022) 496 — Source Summary — withdrawn liability proposal that named the CRA as complementary.