The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, is not just a law for manufacturers of connected hardware. Many software products can fall within its scope. The CRA’s scope may include downloadable applications, enterprise software, software agents, libraries and other commercially supplied software components, provided they meet the CRA’s definition of a “product with digital elements.” An analysis must consider the product’s functionality, intended use and connection to devices or networks, not simply whether it is delivered as software rather than as a physical product.
How does the CRA treat “software”?
US businesses sometimes overlook that the CRA’s scope extends beyond hardware to many software products, including downloadable applications, enterprise software, software agents and separately marketed software components. They may meet the definition of a “product with digital elements” under Articles 2(1) and 3(1), including the required direct or indirect connection to a device or network.
Cloud functionality also be covered if it supports a software or hardware product: under Article 3(1)–(2) and Recitals 11–12, remote data processing falls within scope where it is developed by or under the responsibility of the product manufacturer and its absence would prevent the product from performing one of its functions. By contrast, standalone SaaS is not automatically covered merely because it processes data remotely. Even if it is not in scope for the CRA, however, a SaaS product may still be subject to DORA or NIS 2.
The covered businesses should also check whether a product falls within an “important product with digital elements” category in Annex III. Class I, point 4, lists “software that searches for, removes, or quarantines malicious software.” Products meeting this category may face additional conformity-assessment requirements under Article 32, depending on the applicable assessment route and conditions.
The CRA reaches companies established outside the EU.
Another aspect that is also often overlooked: A U.S. company that places covered products on the EU market can have direct manufacturer obligations; importers and distributors may have separate duties. Companies should therefore assess their EU product offerings even if they have no establishment in the EU.
They should also look at the various implementation laws in the EU member states that could differ significantly. Germany adopted its CRA implementation legislation in October 2026 that already passed the lower Chamber (Bundestag). It designates the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, or BSI) as the principal market-surveillance authority and gives it key roles in notification and cybersecurity incident response. Other EU Member States are establishing their own national enforcement arrangements, while the underlying CRA requirements apply across the EU.
Key dates
- September 11, 2026: Reporting obligations already apply to the covered manufacturers for actively exploited vulnerabilities and severe security incidents affecting covered products. The CRA requires an early warning within 24 hours and subsequent reporting within 72 hours.
- December 11, 2027: Most substantive requirements apply, including cybersecurity-by-design, vulnerability handling, technical documentation and applicable conformity-assessment and CE-marking requirements.
Potential fines and other penalties
Depending on the infringement, administrative fines can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher. Other specified violations can attract fines of up to €10 million or 2% of worldwide annual turnover; providing incorrect, incomplete or misleading information to authorities or notified bodies can attract fines of up to €5 million or 1%. Raising the stakes for U.S. companies, market surveillance authorities may also impose market access restrictions on non-compliant products even if the regulator would otherwise struggle to assert jurisdiction.
Exemptions and special supervision
The CRA excludes certain products already covered by specific EU sectoral legislation, as well as products developed exclusively for national security or defense purposes. Products that are high-risk AI systems under the EU AI Act are subject to special rules. In Germany, the Federal Network Agency (Bundesnetzagentur, or BNetzA) now oversees CRA compliance for those products, in cooperation with the BSI.
What U.S. companies should do now
Inventory software and connected products supplied into the EU, assess which products and components fall within scope, and determine the company’s role as manufacturer, importer or distributor. Review vulnerability-handling and incident-reporting procedures immediately and start preparing for the December 2027 CRA requirements. Product redesign and conformity assessment may require significant lead time.
