EU Cyber Resilience Act · Regulation (EU) 2024/2847
Cyber Resilience Act compliance and requirements, so every connected product you sell in the EU can carry the CE mark.
From 11 December 2027, hardware and software with digital elements needs secure design, a vulnerability handling process, technical documentation and a conformity assessment before it reaches the EU market, and manufacturers have had to report actively exploited vulnerabilities since 11 September 2026. Sterling's expert and experienced consultants turn those obligations into routines your product, engineering and support teams can run. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cybersecurity and product compliance consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the process and the evidence; conformity is declared by you or assessed by a notified body, and market surveillance authorities enforce
8,100+ client engagements in 60+ countries.
Cyber Resilience Act client experience
What it is
What is the EU Cyber Resilience Act and what is it used for?
The Cyber Resilience Act, formally Regulation (EU) 2024/2847, sets horizontal cybersecurity requirements for products with digital elements: hardware and software, together with the remote data processing a product depends on. Like other EU product laws, it works through essential requirements, a conformity assessment, an EU declaration of conformity and the CE marking.
Products must ship with security proportionate to their risks, and manufacturers must handle vulnerabilities for a declared support period, normally at least five years. As a regulation, it applies directly in every Member State.
Current text. Regulation (EU) 2024/2847 of 23 October 2024, in force since 10 December 2024. The rules on notified bodies apply from 11 June 2026, the reporting obligations from 11 September 2026 and the remaining obligations from 11 December 2027. Harmonised standards were still being drafted in September 2026, and none had been cited in the Official Journal.
Who it is for
Who needs to comply with the Cyber Resilience Act?
Any manufacturer placing a connected product or software on the EU market, wherever it is based, plus importers and distributors. Products already covered by sector rules, such as medical devices, motor vehicles, civil aviation and marine equipment, sit outside it. Enquiries usually start from one of four places:
- An EU distributor or OEM customer asks for evidence. Importers must check conformity before they sell, so supplier questionnaires arrive early.
- A tender or procurement framework references the Regulation. Buyers now ask for a declared support period and a disclosure policy up front.
- A market surveillance authority or CSIRT is now in the picture. Since September 2026 an actively exploited vulnerability in any product you have on the market triggers a report.
- A parent company or group platform sets the rule. Groups selling several product lines into the EU usually want one secure development and disclosure process for all of them.
Requirements
What are the main Cyber Resilience Act requirements?
The core sits in Annex I, split into properties of the product and duties for handling vulnerabilities, with the manufacturer's obligations, reporting and conformity assessment set out in the Articles. The list stays at heading level; the Regulation itself is the test.
- Annex I, Part I, product properties: risk-based security, no known exploitable vulnerabilities at release, secure defaults, updates, access control, confidentiality, integrity, availability and a limited attack surface.
- Annex I, Part II, vulnerability handling: a software bill of materials, prompt remediation, regular testing, coordinated disclosure and security updates delivered free of charge.
- Manufacturer obligations (Article 13): a cybersecurity risk assessment, due diligence on third-party components, a support period of at least five years unless the product's expected use is shorter, and records kept for the authorities.
- Reporting (Article 14): actively exploited vulnerabilities and severe incidents notified through ENISA's single reporting platform, with an early warning within 24 hours and a notification within 72 hours.
- User information (Annex II): contact and reporting point, intended use, end of support and update instructions.
- Conformity (Article 32 and Annexes V to VIII): the assessment procedure for the product's category, technical documentation, an EU declaration of conformity and the CE marking.
What does useful Cyber Resilience Act evidence look like?
A risk assessment per product that explains which Annex I properties apply and how each is met; a current SBOM tied to each release; test and penetration results; a published disclosure policy with a working intake address; update records showing how fast fixes shipped; the declared support period; and a technical file an authority can follow.
Compliance route
How do you comply with the Cyber Resilience Act?
There is no Cyber Resilience Act certificate to collect. Conformity is shown per product, and the category of the product decides whether you may assess it yourself or must involve a notified body.
- 01Inventory and classify your products.List every product with digital elements you place on the EU market and decide whether each is a default product, important Class I or II under Annex III, or critical under Annex IV.
- 02Gap analysis: compare your products and processes with Annex I.We review design, development, testing, release and support practice for each product family, then agree actions, owners and dates.
- 03Build the secure development and vulnerability handling routines.Risk assessment, SBOMs, a disclosure policy, the update pipeline and a rehearsed 24-hour report.
- 04Prepare the technical documentation and choose the procedure.Internal control (Module A) for most products; EU-type examination or full quality assurance with a notified body, or a European cybersecurity certification scheme, where the category requires it.
- 05Declare conformity, affix the CE marking and keep supporting.Sign the EU declaration of conformity, then keep patching, reporting and updating the file for the support period.
Check the route before you sign. Notified bodies for this Regulation are notified by Member State authorities and listed in the Commission's NANDO database. Ask any body you consider for its notification number and the procedures it is notified for, then confirm both in NANDO. The certification buyer's checklist
Cost
How much does Cyber Resilience Act compliance cost?
The budget is driven by products, not headcount. One firmware family on a mature pipeline is a far smaller job than a catalogue of legacy devices with no update channel.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | The number of product families, their categories, and whether you choose Design™ or Drive™ |
| Notified body or certification scheme | Only where third-party assessment is required; shown separately |
| Security testing | Testing depth, in-house or external |
| Your team's time | Engineering effort to fix findings, generate SBOMs and add update capability |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- Product lines in scope and how many are important or critical
- The maturity of secure development and patching today
- Legacy products still sold after December 2027
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones linked to deliverables
- One all-inclusive proposal for our work
Timeline
How long does Cyber Resilience Act compliance take?
Products placed on the market from 11 December 2027 must conform. Before that, the pace depends on product count, engineering change and, for Class II and critical products, notified body availability. As an estimate, most programmes take six to twelve months.
| Phase | What sets the pace |
|---|---|
| Inventory and gap analysis | Access to product owners, architecture and release records |
| Process and product remediation | Engineering capacity, component upgrades and update tooling |
| Technical documentation | Test evidence, SBOMs and the risk assessment per product |
| Third-party assessment, where required | Notified body availability and time to close its findings |
Your engagement
What your Cyber Resilience Act engagement includes
Sterling OS™ runs every engagement, and each phase has a meaning for product security. Sterling does not certify or act as a notified body: you declare conformity, and where your category requires it a notified body assesses your product.
Design™: guided support
Your engineers build the routines and technical file; a Sterling consultant sets the method, reviews outputs and coaches.
Drive™: managed support
The alternative to Design™ for stretched teams: Sterling drafts assessments, policies and documentation with your owners and runs the programme to the declaration.
Sustain™: after the declaration
Internal audits, patch-time reviews, reporting drills and technical file updates as products change.
Automate™: Effivity
Risks, vulnerabilities, corrective actions and documents held in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Conformity decisions remain with the manufacturer and, where required, the notified body.
Often combined with
Standards organisations pair with EU Cyber Resilience Act
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CE markingCE marking compliance support for manufacturers: EU rules, technical files, declaration of conformity and quality systems.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
Effivity · security and compliance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Cyber Resilience Act.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For a Cyber Resilience Act client, your consultant sets up a workspace within the agreed scope that holds product risk assessments, the vulnerability and corrective action log, controlled policies and procedures, supplier and component evaluations, training records, internal audits and management review. Your build tools still generate the SBOMs and ship the updates; Effivity keeps the decisions and records around them, so the technical file stays current. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Product register and categories
Every product with digital elements, its category, market dates and declared end of support, in one reviewed list.
Cybersecurity risk per product
Threats, the Annex I properties that apply and the chosen treatments, versioned with each significant release.
Suppliers and components
Evaluations of chip, module and software suppliers, with the evidence gathered before a component is used.
Intake, triage and fixes
Reports from researchers, customers and scanners logged, assessed and tracked to a shipped update with dates.
Exploited vulnerabilities and incidents
A record of each case that met the reporting threshold, when the clock started and what went to the authority.
Policies and the technical file index
The disclosure policy, secure development procedure and file contents under version control and approval.
Training for engineers and support
Secure coding, triage and reporting training recorded per person, linked to Sterling Academy.
Internal audit and management review
Audit programmes and review records showing patch times, open vulnerabilities and the actions decided.
What this means at the audit
A market surveillance authority or notified body will pick a product and ask how you know it shipped without known exploitable vulnerabilities, and how quickly the last reported one was fixed. With Effivity, the risk assessment, the vulnerability record and the update decision behind that answer are already linked and dated.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, ISMS, privacy and more when you integrate other standards
Sterling Academy · security e-learning
Give developers, testers and support staff one shared view of product security.
Sterling Academy offers video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training so everyone knows what a reportable vulnerability looks like
- Internal auditor training, as applicable to your standard, as part of the engagement
- Progress reports by team, ready for an authority's questions on competence
- New engineers trained as they join, so records stay current
Keep exploring
Explore more about EU Cyber Resilience Act
Cyber Resilience Act resources
Services for EU Cyber Resilience Act
Why Sterling
Want successful Cyber Resilience Act compliance? Come to Sterling.
Sterling puts one secure development and disclosure process across every product line and site, with one engagement team accountable.
60+ countries since 2003
Security and product compliance programmes for manufacturers and technology firms, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; notified body and testing charges shown separately.
Built with ISO/IEC 27001 in mind
Where an information security management system exists, the new routines sit inside it.
Expert and experienced consultants
Security specialists who learn your release cycle before they write a single procedure.
The Sterling Promise
What our Cyber Resilience Act success guarantee means
We stay with you until your agreed Cyber Resilience Act outcome is achieved, through implementation, the technical documentation and the closure of any notified body findings.
The engagement identifies the Regulation, the products in scope, the outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. You sign the EU declaration of conformity; where required, the notified body assesses conformity and retains its decision. Our commitment concerns the agreed compliance support, not a promise that no vulnerability will ever be found.
FAQs
Frequently asked questions about the Cyber Resilience Act
Does the Cyber Resilience Act apply to products already on the market?
The reporting duty does: since 11 September 2026 it covers actively exploited vulnerabilities and severe incidents in products you have already placed on the market. The essential requirements and CE marking bite on products placed on the market from 11 December 2027; a product substantially modified after that date is treated as new.
Does the Cyber Resilience Act cover SaaS and cloud services?
Not as stand-alone services. Remote data processing is covered only where the product needs it to work.
Is open-source software in scope?
Only when it is made available in the course of a commercial activity. Open-source software stewards have lighter duties, and their reporting obligations start on 11 December 2027.
Does ISO/IEC 27001 certification prove Cyber Resilience Act compliance?
No. It shows an organisation manages information security, which helps, but the Regulation judges each product against Annex I and asks for a technical file and a declaration per product.
What are the Cyber Resilience Act penalties?
Fines are set by Member States within ceilings in the Regulation; for breaches of the essential requirements or the Article 13 and 14 duties, the top tier reaches 2.5% of total worldwide annual turnover or the fixed ceiling in Article 64, whichever is higher.
Keep exploring
More on EU Cyber Resilience Act and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your Cyber Resilience Act compliance before December 2027.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice