What is the Cyber Resilience Act (CRA) in the EU?

The CRA is a regulation designed to improve the cybersecurity of digital products sold in the EU by requiring secure-by-design practices, vulnerability handling processes, and full lifecycle security documentation.

Who needs to comply with the CRA?

Any manufacturer, importer, or distributor of connected hardware or software products sold into the EU, with few exemptions such as medical or automotive sectors.

What is the deadline for CRA compliance?

While most obligations take effect in December 2027, vulnerability disclosure requirements start as early as September 2026.

What happens if a company fails to comply?

Penalties range from €5 million to €15 million or 1% to 2.5% of global turnover. Importers and distributors can also face fines. Non-compliance may lead to product recalls or market bans.

What does the CRA require for vulnerability management?

Key requirements include secure-by-design development, 24-hour vulnerability disclosure, SBOM generation, regular audits, and documentation of remediation efforts.

How does Brinqa support CRA vulnerability management?

Brinqa enables centralized visibility, contextual risk scoring, automated remediation workflows, and audit-ready reporting to help teams comply with CRA Articles 13 and 14.