If you design and sell a device that runs firmware and connects to a network or to another device - a sensor, a smart home gadget, a gateway, a wearable, a controller for a machine - the Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") applies to you. For device makers the hardest part is not the paperwork. It is the promise behind it: security updates for years after the sale, and a date you must print before anyone buys.
Why your device is in scope
The CRA covers hardware and software products whose intended or foreseeable use includes a data connection to a device or network (Art. 2(1)). Firmware is software, and the device that runs it is hardware with digital elements. It does not matter whether the connection is Wi-Fi, Bluetooth, Zigbee, a cellular modem or a USB cable to a PC.
Your companion app and cloud backend can count too. "Remote data processing" is part of the product when the device cannot perform one of its functions without it (Art. 3(2)). A thermostat that is only controllable through your cloud brings that cloud into scope. More on where the line runs in our scope check.
The support period: at least five years, set by you, shown at purchase
During the support period you must handle vulnerabilities in the device "including its components" (Art. 13(8)). The CRA does not fix one number for every product. You decide, but within rules:
| Rule | Where |
|---|---|
| At least 5 years; if the device is expected to be in use for less, the support period equals the expected use time | Art. 13(8) |
| Base it on reasonable user expectations, the nature and intended purpose of the product and Union law on product lifetime | Art. 13(8) |
| You may also look at similar products of other manufacturers, the availability of the operating environment and the support periods of third-party components that provide core functions | Art. 13(8) |
| Record how you set it in the technical documentation | Art. 13(8) |
| Communicate the end date clearly to the user at the time of purchase | Art. 13(19) |
| Keep each security update available for 10 years after release, or for the support period if longer | Art. 13(9) |
| Tell users clearly when support ends and what the risks of continued use are | Art. 13(11) |
For firmware the third-party point matters most. If your device runs on a chip vendor's SDK, a Linux board support package or a radio stack you cannot patch yourself, their support period limits yours. Ask your suppliers for their dates now, before you commit to a number on the box.
A practical consequence: a device you sell in December 2027 with a five-year support period needs security fixes until at least December 2032. Budget for it as a running cost, not as a one-off project.
What the CRA expects from your firmware
Annex I, Part I, lists the essential requirements. For connected devices these are the ones that usually need engineering work:
- No known exploitable vulnerabilities when the device is made available (point 2(a)). Check your dependencies before every production firmware image.
- Secure by default, including the possibility to reset the device to its original state (point 2(b)). In practice: no shared default passwords, unused services and ports closed.
- Security updates, "including, where applicable, through automatic security updates" switched on by default, "with a clear and easy-to-use opt-out mechanism" (point 2(c)). Your users must also get instructions on how to install updates and how to switch automatic updates off (Annex II, point 8).
- Protection against unauthorised access, confidentiality and integrity of data, commands, programs and configuration (points 2(d)-(f)). Signed firmware images are the usual way to protect integrity.
- Limited attack surface and protection of essential functions, also after an incident (points 2(h) and (j)).
- Secure, permanent removal of all data and settings by the user (point 2(m)) - important for devices that are resold.
Annex I, Part II, adds the vulnerability handling process: an SBOM of the components in the firmware (point 1), fixes without delay and, where technically feasible, security updates separate from feature updates (point 2), a coordinated vulnerability disclosure policy and a contact address (points 5 and 6), secure distribution of updates (point 7) and updates free of charge, with advisory messages (point 8). See CRA SBOM and technical documentation.
Is your device an "important product"?
Most devices are in the default category and can use self-assessment. Annex III lists "important products" that need more. Categories in Class I that are typical for device makers:
| Annex III, Class I | Examples |
|---|---|
| Routers, modems intended for connection to the internet, and switches | Home router, LTE modem, managed switch |
| Smart home products with security functionalities | Smart door locks, security cameras, baby monitoring systems, alarm systems |
| Smart home general purpose virtual assistants | Smart speaker with an assistant |
| Internet-connected toys with social interactive or location tracking features | Talking toy with an app |
| Personal wearables with a health monitoring purpose or intended for children | Health tracker, child smartwatch |
| Microprocessors and microcontrollers with security-related functionalities | Secure MCU sold as a component |
For Class I you may self-assess only if you applied harmonised standards, common specifications or a European cybersecurity certification scheme; otherwise a notified body must assess the product. Firewalls, intrusion detection systems and tamper-resistant microcontrollers are Class II and always need third-party assessment. Details in important and critical products.
Devices already on sale: each unit counts
Devices placed on the EU market before 11 December 2027 only fall under the full CRA if they are substantially modified after that date. The reporting duty, however, applies to all of them already now.
In EU product law "placing on the market" happens per individual unit, not per model (Blue Guide, section 2.3). A unit you deliver to a distributor in November 2027 can be sold to a customer in 2028 without CRA conformity. A unit of the same model that leaves your factory in January 2028 must comply in full. If you plan to keep a model on sale after 2027, plan its CRA conformity, not a stock-up.
A firmware update can also make a difference: a substantially modified version is treated as a new product (Art. 13(10)). Security fixes alone normally are not a substantial modification; a release that changes the intended purpose or adds new risky functions can be.
Radio devices: one regime instead of two
Since 1 August 2025 Wi-Fi, Bluetooth and other radio devices have had to meet cybersecurity requirements under the Radio Equipment Directive (Delegated Regulation (EU) 2022/30, with the EN 18031 standards). Delegated Regulation (EU) 2026/339 repeals those rules from 11 December 2027, the day the CRA applies in full. Until then both apply in their own time frames: RED for radio devices placed on the market now, CRA reporting since September 2026. If you already did EN 18031 work, much of it (access control, secure updates, data protection) carries over to the CRA requirements.
A checklist for device makers
| By when | What |
|---|---|
| Now | Contact address and disclosure policy published (for example security.txt); people registered on ENISA's Single Reporting Platform; a process to report exploited vulnerabilities in 24 hours (how) |
| Now | SBOM for each current firmware image; daily check of components against known exploited vulnerabilities |
| Q1 2027 | Ask chip, SDK and module suppliers for their support periods; decide yours and where the end date appears (box, product page, shop) |
| Q2 2027 | Check update delivery: signed images, automatic updates on by default with opt-out, separate security releases |
| Q3 2027 | Classify the device (default, Class I, Class II); for Class I without harmonised standards, book a notified body early |
| By 11 Dec 2027 | Technical documentation, EU declaration of conformity, CE marking under the CRA |
The full sequence is in the CRA timeline.
Not sure where your device stands?
Take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes, result on screen and checklist by e-mail. Take the free check
Earlybell works for small device makers too: connect your firmware repository, and we generate the SBOM with every release, check your components daily, draft your 24-hour and 72-hour reports for you to submit, and keep your disclosure policy and security.txt up to date. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act), Delegated Regulation (EU) 2026/339 and guidance published by the European Commission. It is not legal advice. Article numbers refer to Regulation (EU) 2024/2847.