What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, makes cybersecurity a legal requirement for products with digital elements sold on the EU market, from connected devices to standalone software, wherever the manufacturer is based. Reporting duties for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026. The main product requirements and CE marking follow on 11 December 2027.
As a globally accredited certification body active in 60+ countries, DQS audits and certifies the management systems behind those products: ISO/IEC 27001 for information security and ISO 9001 for quality. Manufacturers can use these certificates as independent, audited evidence behind their CRA conformity. DQS has also applied for notification as a conformity assessment body for Module H, the full quality assurance route under the CRA.
ISO/IEC 27001-aligned audits
Independent audits of the information security management system behind your products, structured in line with BSI TR-03183-H where a product scope applies.
ISO 9001 integration
Quality and information security audited in one coordinated programme, with one audit plan and fewer duplicate evidence requests.
Module H: application submitted
DQS has applied for notification as a conformity assessment body for Module H. The decision is pending.
Reporting live since 11 September 2026
Actively exploited vulnerabilities and severe incidents must now be reported to the national CSIRT and ENISA, including for products already on the market.
DQS AS A TRUSTED PARTNER
Independent audit experience behind the evidence
Accreditation and audit scale are what make a certificate credible to customers, OEM buyers and market surveillance authorities. The figures below cover DQS across all standards.
3,100+ Auditors worldwide
Across information security, quality and further management system standards.
65,000+ Certified locations
Across all DQS standards.
60+ Countries
Local auditor presence across Europe, Asia-Pacific and the Americas.
40+ Years of experience
Founded in 1985 by DGQ and DIN as Germany's first management system certification body.
From voluntary to mandatory
Product cybersecurity in the EU used to be largely voluntary or sector-specific. The CRA makes it a legal requirement for products with digital elements. It applies across the product lifecycle, from design to the end of the support period, and is enforced through CE marking and market surveillance.
Every role that sells into the EU
Manufacturers, importers and distributors, including companies based outside the EU. Gaps can mean products that cannot carry CE marking, corrective orders or withdrawal from the market, and fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaches of the essential requirements.
Evidence, not a CRA certificate
The CRA itself is not certifiable. Independent audits of the management systems behind development and vulnerability handling give customers and authorities audited evidence. DQS audits and certifies those systems; the declaration of conformity stays with the manufacturer.
CRA in short
The regulation at a glance: what it is, who it covers, what it requires and how conformity is shown.
| What it is | An EU regulation that sets horizontal cybersecurity requirements for products with digital elements, from design to the end of the support period. |
| Who it covers | Manufacturers, importers and distributors that make products available on the EU market, wherever they are based. |
| What it requires | Security by design and by default, vulnerability handling, security updates, a software bill of materials (SBOM), technical documentation and reporting of actively exploited vulnerabilities and severe incidents. |
| How conformity is shown | Through a conformity assessment, an EU declaration of conformity and CE marking. Higher-risk products involve a notified body or a European cybersecurity certification scheme. |
| When it applies | Reporting duties since 11 September 2026; main product requirements, conformity assessment and CE marking from 11 December 2027. |
Your role in the supply chain decides where the duties sit
SCOPE
What counts as a product with digital elements?
The CRA covers hardware and software products, and the remote data processing solutions they depend on, whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
| Typically in scope | Typically outside scope |
|---|---|
|
|
The lists above are a summary. Article 2 of the regulation defines the scope and exclusions in full.
What does the CRA require?
Seven questions every product with digital elements must be able to answer. Each one maps to the essential requirements in Annex I of the regulation.
Annex I, Part I: products are designed, developed and produced to an appropriate level of cybersecurity based on risk, including protection against unauthorised access, data confidentiality and integrity, and a reduced attack surface.
Products are placed on the market without known exploitable vulnerabilities and with a secure-by-default configuration, including the ability to reset to the original state and, where applicable, automatic security updates.
Manufacturers identify and document components and vulnerabilities, including a software bill of materials (SBOM) in a commonly used, machine-readable format covering at least the top-level dependencies.
Annex I, Part II: vulnerabilities are addressed without delay, products are tested and reviewed regularly, a coordinated vulnerability disclosure policy exists, and fixed vulnerabilities are disclosed publicly.
A support period of at least five years, unless the expected use time of the product is shorter, with the end date stated at the time of purchase and security updates provided promptly and free of charge.
Actively exploited vulnerabilities and severe incidents are reported to the national CSIRT and ENISA: early warning within 24 hours, notification within 72 hours, and a final report within 14 days of a fix or one month for incidents.
Technical documentation covering the risk assessment and the means of compliance, kept for at least ten years or the support period if longer, backed by a conformity assessment, an EU declaration of conformity and CE marking.
Four product categories, four levels of third-party involvement
The higher the cybersecurity risk of a product, the more the CRA expects an independent party to be involved. The category decides which conformity routes are open.
The Commission can update the lists of important and critical products by delegated act, so the product lists should be checked against the current text of Annexes III and IV.
Default products
The large majority of products with digital elements, for example mobile apps, smart speakers or computer games.
Route: self-assessment.
Important products, Class I
Products whose function is relevant to the cybersecurity of others, for example password managers, VPNs, network management systems or operating systems.
Route: self-assessment if harmonised standards are applied in full; otherwise a notified body.
Important products, Class II
Products with a higher risk profile, for example firewalls, intrusion detection and prevention systems or hypervisors.
Route: notified body or European cybersecurity certification scheme.
Critical products
Products with the highest potential impact, for example smart meter gateways, smart cards and secure elements.
Route: notified body or European cybersecurity certification scheme.
How is CRA conformity demonstrated?
The manufacturer carries out the conformity assessment, draws up the technical documentation, issues an EU declaration of conformity and affixes CE marking. Which routes are open depends on the product category.
| Route | What it involves | Typically relevant for |
|---|---|---|
| Module A: internal control | The manufacturer assesses conformity itself and documents the result. | Default products. Important Class I products only where harmonised standards or common specifications are applied. |
| Module B + C: EU-type examination | A notified body examines the product design and technical documentation; the manufacturer then ensures production conforms to the approved type. | Important and critical products, particularly where harmonised standards are not applied. |
| Module H: full quality assurance | A notified body assesses and monitors the manufacturer's quality system covering design, development, production, inspection and vulnerability handling. | Manufacturers with several product lines or frequent releases that prefer one system-level assessment. |
| European cybersecurity certification scheme | Certification under an EU scheme, for example EUCC, where the CRA allows or requires it. | Critical products and, where accepted, important products. |
Harmonised standards, developed by European standardisation organisations such as CEN/CENELEC and ETSI, give a presumption of conformity once they are cited in the Official Journal of the EU. The CRA's obligations do not depend on their availability.
Module H and Technical Guideline TR-03183-H
In Germany, the Federal Office for Information Security (BSI) has published Technical Guideline TR-03183-H, which describes how an ISO/IEC 27001-based information security management system can be refined and extended, with quality-system elements from ISO 9001, to meet Module H requirements for the design, development, production and vulnerability handling of products with digital elements. It is guidance rather than a separate certifiable standard. BSI has also published an accreditation programme setting out what certification bodies must demonstrate to perform Module H conformity assessments on this basis.
Which DQS audits can support CRA evidence?
Two certifiable layers today, and a conformity assessment route for which DQS has applied.
ISO/IEC 27001
An information security management system audited against ISO/IEC 27001 shows that risks across development, production and vulnerability handling are managed systematically. Where a product scope applies, the audit can be structured in line with Technical Guideline TR-03183-H.
Your benefit: accredited, third-party evidence that supports your own technical documentation.
ISO 9001 certification shows that design, change, production and inspection processes are controlled and documented. These are the quality-system elements that Module H builds on.
Your benefit: one audited quality baseline that can be reused across product lines.
DQS has applied for notification as a conformity assessment body for Module H. Once notified, DQS can assess a manufacturer's quality system across design, development, production and vulnerability handling. The manufacturer's own EU declaration of conformity and CE marking remain in place.
Your benefit: an audited foundation today that carries forward into Module H.
New to ISO/IEC 27001?
Most CRA evidence builds on an information security management system. Read the key facts, core requirements and related standards of ISO/IEC 27001.
How the CRA fits with other regulations and standards
Regulations set legal duties; standards give audited evidence. The table shows which question each one answers and where it meets the CRA.
| Regulation or standard | Applies to | The question it answers |
|---|---|---|
| Cyber Resilience Act | Products with digital elements | Is this product secure by design and by default, supported with updates and conformity assessed for the EU market? |
| NIS2 | Organisations in critical and important sectors | Does the organisation manage cybersecurity risk, including supply chain risk, and report incidents? |
| EU AI Act | AI systems | Is AI governed according to its risk level? High-risk AI systems that are also products with digital elements may rely on CRA conformity for the cybersecurity requirement, to the extent it is covered. |
| ISO/IEC 27001 | The organisation's information security management system | Does the organisation run a systematic, independently audited approach to information security? |
| ISO 9001 | The organisation's quality management system | Are design, change, production and inspection processes controlled and documented? |
| ISO 22301 | The organisation's business continuity management system (BCM) | Can the organisation keep critical processes running and recover after a disruption, including one that affects development, security updates or support? |
Where does the CRA stand today?
Regulation (EU) 2024/2847 entered into force on 10 December 2024 and applies in three stages:
- 11 June 2026: rules on notified bodies apply, so EU Member States can notify conformity assessment bodies.
- 11 September 2026: reporting of actively exploited vulnerabilities and severe incidents applies, including for products already on the market.
- 11 December 2027: the main product requirements, conformity assessment and CE marking apply in full.
CEN/CENELEC and ETSI are developing the harmonised standards that will give a presumption of conformity once they are cited in the Official Journal of the EU.
Is the CRA only relevant in Europe?
The CRA applies by market: any manufacturer selling products with digital elements into the EU is in scope, wherever it is based. Other markets are building their own product security rules, each with its own scope and legal status (as of October 2026).
From product inventory to audit evidence
Five steps organisations typically work through. Your role and product category decide the route, and the route decides which evidence you need.
1 | Map your products and your role List which products are products with digital elements and whether you act as manufacturer, importer or distributor for each. | Role and scope determine every obligation that follows. |
2 | Classify each product Place each product in the default, important (Class I or II) or critical category. | The category sets how much third-party involvement is expected. |
3 | Choose the conformity route and module Decide between internal control (Module A), EU-type examination (Module B+C), full quality assurance (Module H) or a certification scheme, where more than one is open. Module H, for example, rests on an assessed quality system rather than a single product design. | A route and module chosen early avoid rework on documentation. |
4 | Build the evidence base Maintain technical documentation, an SBOM, vulnerability handling and reporting processes, supported by audited management systems such as ISO/IEC 27001 and ISO 9001. | Independent audits give customers and authorities more than self-assertion. |
5 | Plan audit capacity early Schedule certification audits ahead of the declaration of conformity, and monitor when notified body capacity opens for your product category. | Audit and notified body slots are limited as the application date approaches. |
This sequence describes what organisations typically do. DQS audits the resulting systems and does not design or implement them.
What an ISO/IEC 27001 audit cycle with DQS includes
- Stage 1: documentation and readiness review
- Stage 2: system audit on site or by suitable remote techniques
- Audit report and closing meeting with potential areas of improvement
- Accredited, internationally recognised certificate after a positive certification decision
- Annual surveillance audits
- Recertification audit before the three-year validity ends
- Certificate listing and validation
WHY DQS
Independent audits, with one consistent approach across your management systems
What this means for you
- Independence: DQS is a certification body, not an advisory firm. It audits what you have built and never designs or implements your controls.
- Product-security awareness: auditors with cybersecurity engineering backgrounds assess development, production and vulnerability handling as your teams actually run them.
- Integrated audit approach: ISO/IEC 27001 and ISO 9001 are covered in one integrated audit programme, which reduces duplicate evidence requests across your portfolio.
- Global reach: one audit programme for product lines and sites in several markets, with local auditors who know the regional market context.
- A clear path to Module H: evidence built on audited ISO/IEC 27001 and ISO 9001 systems is designed to carry forward if notification for Module H is granted.
Ready to see which requirements apply to your products?
Tell us which products you place on the EU market. We confirm the audit scope for your management systems.
Frequently asked questions
What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act, Regulation (EU) 2024/2847, is an EU regulation that sets mandatory cybersecurity requirements for products with digital elements placed on the EU market. It covers hardware and software across the product lifecycle, from design to the end of the support period, and is enforced through CE marking and market surveillance by EU Member States.
Who does the CRA apply to?
The CRA applies to manufacturers, importers and distributors that make products with digital elements available on the EU market, regardless of where they are based. Manufacturers carry the main obligations. Importers and distributors must verify conformity and take on manufacturer duties if they sell under their own name or substantially modify a product. Open-source software stewards have lighter, tailored duties.
Which products are in scope, and does the CRA cover software and SaaS?
In scope are hardware and software products whose intended or reasonably foreseeable use includes a data connection to a device or network, including standalone software and apps. Pure online services such as SaaS are generally outside scope, but a remote data processing solution that a product needs to perform one of its functions is treated as part of the product. Products covered by sector rules, such as medical devices and motor vehicles, are largely excluded.
What are the CRA product categories and why do they matter?
The CRA distinguishes default products, important products (Class I and Class II) and critical products. Default products, the large majority, can use self-assessment. Important products, such as password managers, VPNs, operating systems or firewalls, and critical products, such as smart meter gateways and secure elements, require stronger third-party involvement: a notified body or, where applicable, a European cybersecurity certification scheme. The Commission can update the product lists by delegated act.
Is there a CRA certificate?
No single CRA certificate exists. Manufacturers demonstrate conformity themselves through a conformity assessment, an EU declaration of conformity and CE marking. Depending on the product category, a notified body must be involved, or a European cybersecurity certification scheme may be used. Management system certificates, such as ISO/IEC 27001, can provide independent evidence behind the manufacturer's documentation but do not replace the declaration of conformity.
What is Module H under the CRA?
Module H is the full quality assurance route to conformity assessment. Instead of examining one product type at a time, a notified body assesses and monitors the manufacturer's quality system covering design, development, production and vulnerability handling. It can suit manufacturers with several product lines or frequent releases. Germany's Federal Office for Information Security (BSI) publishes Technical Guideline TR-03183-H, which describes how an ISO/IEC 27001-based management system can be extended to meet Module H requirements.
What must manufacturers report under the CRA, and how fast?
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security. The sequence is an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a corrective measure being available for vulnerabilities, or within one month for severe incidents. Reports go to the designated national CSIRT and ENISA through a single reporting platform.
How long must manufacturers provide security updates?
Manufacturers must provide security updates for a support period of at least five years, unless the expected use time of the product is shorter. The end date of the support period must be clearly stated at the time of purchase. Security patches must be provided without delay and free of charge, and technical documentation must be kept available for at least ten years or for the support period, whichever is longer.
How does the CRA differ from NIS2?
The CRA regulates products: what manufacturers must build into hardware and software, and how they handle vulnerabilities across the product lifecycle. NIS2 regulates organisations in critical and important sectors: how they manage cybersecurity risk, including supply chain security, and how they report incidents. A company can be subject to both, for example a manufacturer that is also an essential or important entity under NIS2.
Does ISO/IEC 27001 certification satisfy the CRA?
Not on its own. ISO/IEC 27001 certifies an organisation's information security management system, while the CRA sets requirements for products. A certificate can still be valuable evidence, because it shows that development, production and vulnerability handling processes in scope are managed and independently audited. Where a Module H route is relevant, Technical Guideline TR-03183-H from Germany's Federal Office for Information Security (BSI) describes how such a system can be extended to address product-level requirements.