EU Cyber Resilience Act (CRA)
The regulation that makes product security a legal duty across the EU. Learn what counts as a product with digital elements, who owes what, the Annex I requirements, product classes and CE marking, and the 24-hour reporting clock — remembered with spaced repetition.
- flashcards
- 80
- flashcards
- per day
- ~10 min
- per day
- level
- Intermediate
- level
- modules
- 5
- modules
What is the Cyber Resilience Act?
The Cyber Resilience Act — Regulation (EU) 2024/2847 — attaches binding cybersecurity requirements to products with digital elements placed on the EU market. Its reach is deliberately horizontal: not a sector, not a company size, but essentially anything whose intended or foreseeable use involves a data connection to a device or network, from a smart plug to a firewall to a library shipped as part of a commercial product.
It entered into force on 10 December 2024 and applies in stages. The duty to report actively exploited vulnerabilities and severe incidents has applied since 11 September 2026, with a 24-hour early warning and a 72-hour notification. The main product obligations — the Annex I essential requirements, conformity assessment, CE marking and the support period you must declare at purchase — apply from 11 December 2027.
This track is written for the people who have to act on it: engineers who now own “no known exploitable vulnerabilities at release” as a shipping condition, product owners deciding how long a device will be supported, and compliance staff mapping classes to conformity routes. It teaches what the regulation requires — the obligations, the deadlines, the classes — and cites the Commission, EUR-Lex and ENISA for each. It is not legal advice, and it says so where the answer genuinely depends on your product.
5 modules, seed to bloom
Each module is a set of flashcards — 80 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
Scope & Definitions
What counts as a product with digital elements, what is carved out, and how open source is treated
16 cardsManufacturer, Importer & Distributor Duties
Who owes what: risk assessment, support periods, documentation, and the duties down the supply chain
16 cardsEssential Requirements (Annex I)
The Part I product properties and the Part II vulnerability-handling duties, including SBOM and disclosure
16 cardsConformity Assessment & CE Marking
Product classes, which route needs a notified body, harmonised standards, and the CE marking itself
16 cardsReporting & Enforcement
The 24/72-hour duties, the Single Reporting Platform, market surveillance, fines and the timeline
16 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
A manufacturer becomes aware of an actively exploited vulnerability at 09:00 on Monday. What is due, and when?
- AAn early warning by 09:00 on Tuesday, and a fuller notification by 09:00 on Thursday
- BA single complete report by 09:00 on Thursday, once the facts have been established
- CAn early warning by 09:00 on Thursday, and a final report fourteen days later
- DA notification to affected customers first, and to the authorities once a fix exists
How long must a manufacturer's support period normally last?
- AAt least five years, unless the product is expected to be in use for a shorter time
- BAt least two years, matching the statutory conformity guarantee for consumer goods
- CAt least ten years for every product with digital elements placed on the EU market
- DFor as long as the manufacturer continues to sell that model to new customers
What must the software bill of materials a manufacturer draws up cover, at minimum?
- AAt least the top-level dependencies of the product, in a commonly used machine-readable format
- BEvery transitive dependency of the product, resolved to an exact version and hash
- COnly the components with a known CVE at the time the product is placed on the market
- DOnly the components the manufacturer did not write itself and cannot patch directly
A maintainer publishes an open-source library and does not monetise it. How does the CRA treat that?
- AIt is not a commercial activity, so the regulation's manufacturer obligations do not attach
- BIt is a commercial activity as soon as businesses depend on the library in production
- CIt is a commercial activity once the project accepts donations of any size at all
- DIt is outside the regulation only while the project has no EU-based maintainers
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
Why the CRA is worth your time
Security becomes a shipping condition
Delivering with a known exploitable vulnerability stops being a backlog decision and becomes a breach of Annex I.
The clock is already running
Reporting duties applied from September 2026. Twenty-four hours from becoming aware is not a policy you write afterwards.
Support periods become a promise
How long a product gets security updates must be decided, disclosed at purchase and honoured — at least five years in the normal case.
It reaches open source, carefully
Unmonetised open source is not a commercial activity, stewards get a lighter regime, and contributors are untouched. Knowing where the lines fall matters.
Common questions
When does the Cyber Resilience Act actually apply? +
It entered into force on 10 December 2024. The reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026, the rules on notifying conformity assessment bodies from 11 June 2026, and the main product obligations from 11 December 2027.
Does the CRA apply to SaaS? +
Not to services as such. It regulates products placed on the market, with one important exception: a remote data processing solution designed by the manufacturer, without which the product could not perform one of its functions, is treated as part of that product.
Does it apply to open-source software? +
Supplying free and open-source software that its manufacturers do not monetise is not a commercial activity, so the manufacturer duties do not attach. Open-source stewards — entities sustaining development of software meant for commercial use — get a lighter set of duties and cannot be fined, and individual contributors are outside the regulation.
How long must a product be supported? +
The support period has to reflect how long the product is expected to be in use, and is at least five years unless the product is genuinely used for less. Separately, each security update issued during that period must remain available for at least ten years after the product was placed on the market.
Is this legal advice? +
No. The deck teaches what the regulation requires — obligations, deadlines, product classes and the reporting mechanics — with every card citing the Commission, EUR-Lex or ENISA. Whether a specific product falls into a given class, and what your organisation should do about it, is a question for your own legal and compliance assessment.
Is it free? +
Yes, completely free. No registration or credit card is required, and all your progress is stored locally in your browser.
Get ahead of December 2027
Plant your first seed today. Ten minutes a day turns a 100-page regulation into obligations you can actually recall when someone asks.