Does the Cyber Resilience Act apply to my product?
Yes, if you make, import or distribute a product with digital elements on the EU market and no Art. 2 exclusion applies, at any company size. Each answer cites the article.
Cyber Resilience Act, explained
Short articles on the EU CRA: every claim checked against the Official Journal text (CELEX 32024R2847), the same corpus the free applicability check runs on.
The 24-hour early warning: what ENISA’s form asks for, field by field
Which fields the reporting platform requires at the early warning, with character limits, set against the text of Article 14. Plus the two footnoted fields and what to have ready before an incident.
When does a vulnerability have to be reported under Article 14?
The test in the text: an actively exploited vulnerability contained in the product, or a severe incident. What each requires, and the clocks that follow.
Free software and the CRA: money is not the test
Recitals 15 and 18, and the Commission's guidance on them: the trigger for free and open-source software is commercial activity, not a price. Eleven situations, sorted.
The CRA support period: five years, or the expected use time
Article 13(8) sets a five-year floor, with one narrow way down. It reaches into pricing, end-of-life notices and your release matrix.
Manufacturer, importer or distributor: which CRA role is yours
Three definitions in Article 3 decide your duties. Put your name on someone else's software and Article 21 makes you the manufacturer.
What the CRA reporting duty requires from 11 September 2026, hour by hour
Article 14 has applied since 11 September 2026: 24 hours, 72 hours, and two different final reports. The duty also covers products already on the market.
How much are CRA fines? Three Article 64 brackets
Article 64 sets three administrative fine ceilings. Which bracket applies follows from the obligation breached; company size plays a role only under Art. 64(10).
CRA timeline: what applies when
Chapter IV has applied since 11 June 2026 and Article 14 reporting since 11 September 2026; the rest of the Regulation, market surveillance included, applies from 11 December 2027. Plus the work each date requires.
Does the CRA apply to SaaS?
Pure cloud services usually escape; shipped client software doesn't. Where the line actually sits.