Full name: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828

(Link to original text)

Type: Regulation

Objective and key elements:

• Setting horizontal baseline of rules for security in the internal market
• Increasing the overall level of cybersecurity of all products with digital elements by introducing essential cybersecurity requirements for such products
• Security updates to be made available for at least 5 years
• Reporting obligations for manufacturers in case of security incidents
• Possibility to recall products not fulfilling the requirements

Relevant to: Manufacturers, importers, and distributors of products and software including digital elements (excluding services, such as SaaS and certain specifically regulated products (e.g. cars)).

Status: In force, will apply from 11 December 2027.

Next steps: Article 14 will apply from 11 September 2026 and Chapter IV will apply from 11 June 2026.

Documents:

• Text adopted by the Council on 10 October 2024 is available here
• Text adopted by the Parliament on 12 March 2024 is available here
• The Council’s proposed amendments on 13 July 2023 is available here
• Commission proposal published on 15 September 2022 is available here

Guidance:

• European Commission: Cyber Resilience Act - Questions and Answers

(Last updated 26 November 2024)

Status:

• The process for national implementation is ongoing in the Ministry of Transport and Communications. More information about the project is available here (in Finnish only).
• While the CRA is directly applicable in all EU Member States, each Member State must supplement the CRA with national legislation by designating supervisory authorities with powers to impose administrative fines.
• The draft government proposal was published on 17 June 2025 and is available here (in Finnish only). The draft proposal was sent out for public consultation and the deadline for comments is 12 August 2025. The final government proposal is estimated to be published in September 2025 and the national legislation to become applicable as of 1 June 2026.

(Last updated 26 June 2025)