What does the CRA require from 11 December 2027?
From 11 December 2027 software and devices with digital elements on the EU market must meet the essential security requirements, have technical documentation (including a list of components), get security patches throughout the support period and carry the CE marking.
- Who must?
- Manufacturers, importers and distributors of software and devices with digital elements on the EU market.
- What to do?
- Risk assessment and security by design.
- Technical documentation: SBOM, vulnerability disclosure policy, support period.
- Declaration of conformity and CE marking before placing on the market.
- Where to file?
- Nothing is filed; the documentation is kept for 10 years and given to market surveillance on request.
- Who checks?
- Market surveillance (national authority)
- Fine
-
We are checking the fine in the source; until then we do not write a number.
- What if I am already late?
- If you already sell the product, prepare the documentation and the assessment by 11 December 2027; VulnClock gives you the SBOM and the daily check right away.
Sort it out
The free solution comes first, then tools. Nobody calls you.
VulnClock GitHub Action free · open sourceSBOM and a daily vulnerability check in your CI (npm, Composer, Android, iOS), flags when a vulnerability is exploited in the wild. Apache-2.0.
Open
VulnClock Pro our toolA 24 h / 72 h / 14-day reporting clock, a tamper-evident decision log, drafts for the ENISA platform. 129 € a month per product.
Sort it out
- Regulation (EU) 2024/2847 (Cyber Resilience Act), art. 13 and 71, read on 23 Oct 2026
Author: 3D&TECH LAB d.o.o. editors · Version 1
This is not legal advice. Deadlines and fines come from the sources listed; check the source before you decide.