EU Cyber Resilience Act (Regulation (EU) 2024/2847)
Status: In force; reporting obligations apply since 11 Sep 2026; main obligations from 11 Dec 2027
Horizontal cybersecurity requirements for products with digital elements placed on the EU market, across their lifecycle. Manufacturers must report actively exploited vulnerabilities and severe incidents via ENISA's Single Reporting Platform (24h early warning, 72h notification, final report). Essential requirements and CE marking apply from 11 December 2027.
Who it applies to
- Manufacturers, importers and distributors of hardware/software products with digital elements on the EU market
- Directly relevant to OT/ICS vendors (PLCs, HMIs, gateways, industrial software) and to asset owners' procurement
Why it matters for OT
OT product vendors selling into the EU fall in scope; asset owners should expect CRA conformity evidence, SBOMs and vulnerability-handling commitments in procurement.
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| Annex I Part I essential cybersecurity requirements (secure by default, access control, data protection, attack-surface limits) | IEC 62443-4-2 (component requirements CR 1–7); 62443-3-3 for systems |
| Annex I Part II vulnerability handling (SBOM, coordinated disclosure, security updates) | IEC 62443-4-1 practices SVV, DM (defect management), SUM (security update management) |
| Art. 14 reporting of actively exploited vulnerabilities and severe incidents | IEC 62443-4-1 DM-1…DM-6 (issue handling), plus PSIRT processes |
IEC 62443 mappings are editorial and indicative. Harmonised standards under the CRA are still being developed — needs verification before relying on any presumption of conformity.
Recent changes
CRA reporting obligations now apply
Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform.
Sources
- European Commission – Cyber Resilience Act digital-strategy.ec.europa.eu
- European Commission – CRA reporting obligations digital-strategy.ec.europa.eu
- ENISA – CRA Single Reporting Platform launched enisa.europa.eu
- EUR-Lex – Regulation (EU) 2024/2847 eur-lex.europa.eu
Monitored for changes: digital-strategy.ec.europa.eu, digital-strategy.ec.europa.eu. Data file: data/regulations/cra.yaml. Not legal advice.
Get CRA changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.