If you sell a product with digital elements into the EU, the reporting obligations started on 11 September 2026. Not 2027. That part is already live.
What is the CRA?
The Cyber Resilience Act, Regulation (EU) 2024/2847, puts cybersecurity requirements on products with digital elements sold in the EU. The definition is broad: hardware with software in it, and software sold on its own. If you ship a product into the EU market, the question is not whether the CRA applies but which class it falls into.
The timetable is split, and the earlier half has already started. Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents: an early warning to ENISA and the relevant national CSIRT within 24 hours, a fuller technical notification within 72 hours, and a final report within 14 days of a fix being available, or within one month for a severe incident. These reporting duties cover products already on the market, not only new ones.
The rest applies from 11 December 2027: secure-by-design engineering, conformity assessment, CE marking, a software bill of materials, and vulnerability handling across the support period you declare. The gap between the two dates is the planning window, and it is shorter than it looks because the reporting obligation needs a working detection and escalation path, not a policy.
Compliance requirements
Reporting is live now. Everything else applies from 11 December 2027, which is what the intervening period is for.
Actively exploited vulnerabilities and severe incidents reported to ENISA and your national CSIRT on a 24 hour, 72 hour and 14 day clock. In force now.
Products placed on the market with no known exploitable vulnerabilities, a secure default configuration, and attack surface minimised.
A coordinated disclosure policy, a process for addressing vulnerabilities, and security updates provided free of charge across the declared support period.
A machine-readable SBOM covering at least the top-level dependencies, maintained rather than generated once.
Self-assessment for default products, a notified body for important and critical classes. The class decides the cost.
Documentation demonstrating conformity, an EU declaration of conformity, and CE marking before the product is placed on the market.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We establish which of your products carry digital elements, whether you are the manufacturer for CRA purposes, and which product class each falls into. The class drives everything downstream.
The live obligation first. We build the detection, triage and escalation path that makes a 24 hour early warning achievable, and test it, because most organisations fail on discovery time rather than on filing.
We assess your engineering and support practices against the essential requirements, and produce a plan sequenced to 11 December 2027.
Your compliance manager works with your engineers on secure defaults, vulnerability handling, SBOM generation and support period commitments.
We produce the documentation set a conformity assessment expects, including the declaration of conformity.
We run the self-assessment, or manage the notified body where your product class requires one.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone