CRA · National Security Authority – Practical information about the Cyber Resilience Act

Cyber Resilience Act (CRA)

EU rules for more secure products with digital elements throughout development, market placement and the support period.

Check whether the CRA applies to me Prepare a product for compliance Choose the correct reporting route

More newsLatest news

View all articles and updates

October 5, 2026

Guidance on reporting obligations under the Cyber Resilience Act (CRA)

What does Article 14 of Regulation (EU) 2024/2847 entail for manufacturers of products with digital components? We have prepared methodological guidance that explains manufacturers’ reporting obligations from the perspective of the National Security Authority (NBÚ) and the national cybersecurity incident response unit SK-CERT. The document will help manufacturers better understand the obligations arising from the…

Read the article

October 2, 2026

Vulnerabilities: What manufacturer must do after placing the product in the market

The product is on the market. Security work does not end there – on the contrary, the next phase begins.

Read the article

September 17, 2026

The Cyber Resilience Act and Public Administration: What You Need to Know and How to Prepare?

The Cyber Resilience Act (CRA) will significantly impact not only manufacturers of digital products but will also bring changes for public sector organizations that purchase, operate, and manage these technologies.

Read the article

September 11, 2026

Article 14 comes into force: what can manufacturers expect from 11 September 2026?

Imagine a vulnerable device that, in the space of a single day, is distributed to thousands of customers across Europe. Until now, in such situations, it has largely been down to the manufacturer’s goodwill as to when and how they inform the public and the authorities. From 11 September 2026, however, this voluntary approach will…

Read the article

Getting started with the CRA

Does the CRA apply to my product?

Check the product, connectivity, commercial activity and exclusions.

Check product scope

What role do I perform?

Identify every role your organisation performs for this product.

Identify my role

Prepare a product for the EU market

Move from product security and evidence to conformity assessment and CE marking.

Open product and conformity guidance

Check dates and what applies now

See the phased dates and the action each one requires.

View the CRA timeline

Do you need to report something?

Mandatory CRA notification

For mandatory reporters handling an actively exploited vulnerability or severe incident.

Start with CRA reporting guidance

Voluntary security report

For researchers, users and other third parties reporting a vulnerability or cyber event.

Choose a voluntary route

Possible product non-compliance

For anyone providing product evidence to market surveillance.

Read how to report non-compliance

CRA or NIS2?

Product reporting under the CRA and entity or service reporting under NIS2 are distinct.

Check the reporting distinction

Choose your role

One organisation can perform several roles for different products. Choose every role that applies.

Manufacturer

Plan product security, evidence, conformity, support, updates and reporting.

Open manufacturer obligations

Importer

Verify a non-EU product before placing it on the EU market.

Open the importer checklist

Distributor

Complete due-care checks and know when to stop distribution.

Open the distributor checklist

Authorised representative

Check the mandate boundary and duties that remain with the manufacturer.

Open authorised representative obligations

Open-source software

Distinguish community activity, a steward and a manufacturer.

Open the open-source guide

Conformity-assessment or notified body

Find the reviewed national route and competence information.

Read how to become a notified body

Buyer or user

Check support, updates and secure-use information and how to raise a concern.

Open information for buyers and users

Key dates and current status

The CRA applies in stages. Check the date connected to your task and the transition rules for the product.

In force

10 December 2024

The CRA entered into force.

Applicable

11 June 2026

Chapter IV provisions on notification of conformity-assessment bodies apply.

Applicable

11 September 2026

Article 14 reporting obligations start to apply.

Future application

11 December 2027

Most other CRA provisions become generally applicable.

View the full timeline and transition rules

Latest guidance and useful resources

Find current official sources through reviewed, task-oriented guidance.

Official legal acts and resources

CRA legal text, Commission guidance and ENISA tools with source status.

Open official CRA resources

Questions, glossary and resource finder

Concise answers, CRA terminology and authoritative sources by task.

Open questions and the glossary

Guidance and updates

Current guidance and notices, separated from expired or superseded items.

View guidance and updates

Find the right contact

General questions, reporting support and product concerns use different routes. Do not send a mandatory notification or sensitive details to a general mailbox.

Question about CRA obligations

Use the route finder for questions about scope, roles, requirements and supervision.

Find the correct CRA contact

Help with CRA reporting

The internal guide identifies the approved service before any external handoff.

Open CRA reporting guidance

Product non-compliance concern

Check what evidence to provide and what happens next.

Prepare a product concern

This page provides general information. The legal text and decisions of the competent authority take precedence.