EU Cyber Resilience Act
Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)
Published by European Parliament and Council of the European Union · Regulation (EU) 2024/2847 — general application from 11 December 2027, with earlier dates for specific provisions
Horizontal cybersecurity requirements for products with digital elements placed on the EU market, covering the whole product lifecycle from design through vulnerability handling and end-of-support.
How it’s structured
- 8 chapters and 71 articles
- 8 annexes, including the essential cybersecurity requirements and the technical documentation content
Who it applies to
Manufacturers, importers, and distributors of products with digital elements that connect, directly or indirectly, to a device or network (Article 2) — no general size threshold; products already covered by other EU product law (for example medical devices, vehicle type-approval, aviation, and marine equipment) are excluded.
How Pentforge uses it in an engagement
- Applicability screening against Article 2's scope and the excluded product categories
- Gap analysis and evidence preparation designed for the CRA's essential cybersecurity requirements — preparation support, not legal advice and not a certification
What you get
- A scoping note on whether the CRA applies to the client's product and which dates attach
- A gap register mapped to the essential cybersecurity requirements in Annex I
Official source
Pentforge does not issue certificates
We assess against EU Cyber Resilience Act — that is a statement about the work, not a certification. Pentforge holds no certifications of its own; the credentials our practitioners hold individually are listed on About.
Request a scoping call