How much can my company be fined under CRA?

Common Questions

What products are covered by the CRA?

The CRA applies to any product with digital elements sold in the EU: IoT devices (smart home, industrial IoT), mobile apps, cloud services, network devices (routers, firewalls), embedded software, connected vehicles, and security software.

What are the core CRA requirements?

Manufacturers must: implement security by design and by default, provide security updates for a defined period, report actively exploited vulnerabilities to ENISA and affected parties, maintain technical documentation, conduct conformity assessment, and affix the CE mark.

How long must CRA security updates be provided?

The duration depends on product type: longer-lifecycle products (e.g., industrial IoT) require extended support; shorter-lifecycle products (e.g., mobile apps) require minimum 5 years or the expected product lifetime, whichever is shorter. High-risk products require longer support periods.

What is a "security vulnerability" requiring disclosure under the CRA?

The CRA defines a vulnerability as a weakness that can be exploited to compromise confidentiality, integrity, or availability. "Actively exploited" vulnerabilities are those with known public exploits or confirmed attacks. These must be disclosed within 90 days of discovery.

Can small manufacturers get relief from CRA compliance?

The CRA applies equally to all manufacturers. However, ENISA provides guidance tailored to different organization sizes, and some member states may offer technical assistance for SMEs. No blanket exemptions exist.

When do CRA penalties begin?

Penalties are enforceable from January 1, 2027. The 24-month transition period (Jan 2025–Dec 2026) is a grace period for manufacturers to implement compliance controls and conduct conformity assessments.