Expert EU cybersecurity knowledge 

Our team possesses in-depth knowledge of the EU Cyber Resilience Act and European cybersecurity standards, providing precise compliance guidance.

Tailored product solutions 

We develop customised strategies for your specific digital products, addressing their unique technical characteristics and risk profiles under the CRA.

Streamlined compliance process 

We offer an efficient process covering assessment, testing, and documentation, simplifying your path to CRA conformity and market access.

Dedicated support, building trust

Benefit from dedicated expert support throughout. Our partnership helps ensure product security and builds confidence.

Achieve CRA compliance efficiently and confidently to access the European market

From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents under Article 14 of the EU Cyber Resilience Act.

Once an organisation becomes aware of a reportable vulnerability or incident, the first notification may be required within 24 hours, followed by a more detailed notification within 72 hours. Being technically prepared is therefore not enough: organisations also need clear responsibilities, escalation rules, documentation and reporting workflows.

Eurofins Electrical & Electronics can help you assess your current level of readiness and strengthen the processes needed to respond within these regulatory timelines.

How we can support you:

Vulnerability reporting process review

We review your existing vulnerability and incident reporting process to determine whether it can support the CRA Article 14 requirements and associated reporting deadlines.

CRA Article 14 gap assessment

We identify gaps between your current practices and the expected reporting requirements, helping you prioritise the areas that require immediate attention.

Roles, responsibilities and escalation

We help you clarify who must detect, assess, approve, escalate and report a vulnerability or severe security incident—including the actions to take when key decision-makers are unavailable.

Documentation and reporting workflow

We support the development or improvement of practical documentation, including reporting procedures, responsibility matrices, escalation workflows and evidence-recording templates.

Operational readiness support

We help your technical, cybersecurity, legal and communications teams understand how information should circulate internally and how reporting decisions can be made within the required timeframe.

Key questions your organisation should be able to answer

• What events could trigger an Article 14 reporting obligation?
• Who decides whether a vulnerability or incident is reportable?
• Who is authorised to submit and approve a notification?
• Can the required information be collected within 24 and 72 hours?
• Which teams must be involved in the escalation process?
• How will decisions, actions and supporting evidence be documented?
• How will affected users be informed when necessary?

What you receive

Depending on your organisation’s needs and current level of maturity, our support may include:

• A review of your existing reporting process
• A documented CRA Article 14 gap assessment
• Prioritised recommendations and remediation actions
• A proposed roles and responsibilities matrix
• A vulnerability and incident escalation workflow
• Reporting and evidence-recording templates
• A practical roadmap for improving operational readiness

Be prepared before the reporting clock starts

Article 14 reporting obligations apply from 11 September 2026, ahead of the CRA’s broader application from 11 December 2027. Preparing now can reduce uncertainty, clarify responsibilities and help your teams respond more effectively when a reportable event occurs.

The EU Cyber Resilience Act (CRA), which entered into force on December 10, 2024, establishes a comprehensive framework for cybersecurity requirements for products with digital elements placed on the EU market. Its primary objective is to improve the cybersecurity of hardware and software products throughout their lifecycle, ensuring a higher level of security for consumers and businesses across the European Union.

The CRA introduces mandatory cybersecurity requirements for manufacturers, importers, and distributors, aiming to address the growing threat landscape and the current low level of cybersecurity in many digital products.

Key requirements

The CRA outlines essential cybersecurity requirements that products with digital elements must meet. These include:

• Security by design and default: Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on identified risks. They should be placed on the market with a secure configuration by default.
• Protection against unauthorised access: Products must protect against unauthorised access through appropriate control mechanisms, such as authentication and identity management systems.
• Data confidentiality and integrity: Products must protect the confidentiality and integrity of stored, transmitted, or otherwise processed data, including personal data, using mechanisms like encryption.
• Availability of functions: Products must protect the availability of their essential functions, including resilience against and mitigation of denial-of-service attacks.
• Minimising attack surface: Products should be designed and developed to limit attack surfaces and reduce the impact of security incidents.
• Vulnerability handling: Manufacturers must identify and document vulnerabilities, address them promptly through security updates, and have a policy for coordinated vulnerability disclosure.
• Information and instructions: Products must come with clear and understandable instructions on their secure installation, configuration, and use, including information on security updates and how to securely remove data.

Obligations for Economic Operators

The CRA imposes specific obligations on actors in the supply chain:

• Manufacturers: Must ensure products meet essential cybersecurity requirements, conduct risk assessments, implement vulnerability handling processes, provide security updates for the product's support period, draw up technical documentation and an EU Declaration of Conformity, and affix the CE marking. They also have reporting obligations for actively exploited vulnerabilities and severe incidents.
• Importers: Must verify that products comply with the CRA, including checking for the CE marking, the EU Declaration of Conformity, and the manufacturer's contact details and instructions. They must not place non-compliant products on the market and must inform authorities if a product poses a significant risk.
• Distributors: Must act with due care to ensure products comply with the CRA, verifying the presence of the CE marking and required documentation. They must not make non-compliant products available and must inform manufacturers and market surveillance authorities of identified risks.

Scope

The CRA applies to a broad range of products with digital elements whose intended or foreseeable use includes a direct or indirect connection to a device or network. This covers most hardware and software products, including IoT devices, software applications, and components. Certain products already covered by existing EU legislation (e.g., medical devices, vehicles, aviation) and specific types of open-source software are generally excluded. Products are categorised based on risk level, which determines the required conformity assessment procedure (self-assessment or third-party evaluation).

Enforcement and penalties

The CRA grants market surveillance authorities in EU Member States powers to enforce the regulations, including requesting documentation, conducting checks, and imposing corrective measures. Non-compliance can lead to significant penalties, with maximum fines reaching €15 million or 2.5% of the company's total worldwide annual turnover, whichever is higher.

Eurofins Electrical & Electronics can help manufacturers, importers, and distributors navigate the complexities of the CRA. We offer expert testing, assessment, and advisory services to ensure products meet mandatory security requirements, such as banning default passwords, implementing vulnerability disclosure policies, and providing security update transparency.

This support helps businesses achieve compliance efficiently, access the EU market, and mitigate potential penalties.