The reporting obligation already applies. From December 2027, your device only gets the CE mark with CRA proof. In one day you will know where your product and your organization stand.
Format
CRA Deep Dive, one day
Price
Fixed price
Result
Gap list, separated into organization and device
Deadlines
Reporting obligation since 11 Sep 2026 · Full application from 11 Dec 2027
Basics
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) regulates the cybersecurity of products with digital elements. It applies to manufacturers, importers and distributors of devices with software and a data connection, whether wireless or wired.
Standard products
Self-assessment is enough.
Important products (Class I and II)
For Class I without a harmonized standard, effectively a notified body.
Critical products
Strictest level with its own testing obligations.
The situation
As an EU regulation, the CRA has applied directly in all member states since 10 Dec 2024. The obligations apply in stages, and the first one is already running.
In our project experience, implementation in a company takes 18 to 24 months. That is an empirical value, not a legal requirement.
10 Dec 2024
The CRA enters into force
11 Sep 2026 · already applies
Reporting obligation for actively exploited vulnerabilities
It also applies to devices already in the field. The deadlines are in the Basics section.
11 Dec 2027
CE mark only with CRA proof
Then the remaining obligations apply, including Annex I, conformity assessment and at least five years of security updates. They apply to products placed on the market from this day.
Wireless or wired
With wireless
Since August 2025, radio devices must meet cyber requirements from the Radio Equipment Directive, tested to EN 18031. From 11 Dec 2027 the CRA replaces this obligation.
Good EN 18031 work carries over: Many pieces of evidence can be mapped to the CRA's technical security requirements for your device.
Wired only
For purely wired devices there was no comparable cyber obligation in the CE procedure so far. The CRA applies anyway, including with an indirect connection, for example via a gateway.
Hybrid devices carry the radio obligation today and the CRA for the whole device from 2027.
It covers all elements of the radio requirements and adds five more.
Software bill of materials (SBOM)
Vulnerability management
Coordinated disclosure
Reporting to ENISA
Support period
The device check
If you cannot answer one of them with yes, you know where the work begins.
1
Security updates, preferably automatic, with protected integrity and separate from feature updates.
2
Machine-readable, at least with the top-level dependencies. The modem firmware belongs in it too.
3
Early warning, notification and final report run through the ENISA reporting platform.
4
Technical documentation with risk assessment, to be kept for ten years.
Division of labor
This also applies when others develop for you. The contract regulates who delivers what to whom. Responsibility towards the authority stays with you, including due diligence for third-party components.
Evidence is created during development, not at the end. That is why development and regulatory work sit at the same table from the start.
Who does what
IOX implements in the device:
→ Secure boot
→ Remote updates
→ Software bill of materials
→ Key management
→ Radio approval
A consulting partner accompanies the regulatory side:
Classification of the obligations, concept paper and gap list, so your management can decide.
Process
Step 1 · CRA Deep Dive
One day at a fixed price. We go through your product and your organization together.
The Deep Dive does not replace legal advice.
Deep Dive key facts
Price: Fixed price that we name in the first call.
Location: Online or on site, at your place or in Cologne.
Participants: The person who makes the final decision and the experts who know your product best.
Documents: Please don't send anything confidential yet. We are happy to sign a non-disclosure agreement before exchanging documents.
Step 2 · Gap list
Separated into organization and device, complemented by a concept paper. The result belongs to you.
Step 3 · Implementation in the device
We implement what is missing. The evidence is created directly during development.
Are you still at the start of your product development? Then the Accelerator Sprint fits.
Proof
150+
Projects around connected products.
For the sensor and gateway of a car wash manufacturer, in operation.
Developed for a pump manufacturer, with the upcoming requirements in mind.
[Photo]
Who leads the Deep Dive
[Two sentences on experience with embedded, radio, cloud and CE procedures]
Frequently asked questions
Are we still the manufacturer if others do the development?
Yes, as soon as the product comes to market under your name or brand. The manufacturer is whoever develops a product or has it developed and markets it under their own name or brand.
A development contract only regulates who delivers what to whom. Responsibility towards the authorities stays with the manufacturer, including due diligence for purchased third-party components. If you develop on commission and do not market the product yourself, you should clearly delimit the roles with the client by contract.
Does the CRA also apply to devices that have already been sold?
The design and documentation obligations apply to products that are placed on the market or substantially modified from 11 Dec 2027. The reporting obligations, however, have applied since 11 Sep 2026 to products that are already in the field.
For manufacturers with installed devices this means: The process for vulnerability reports must be in place before the other obligations take effect. You should be able to report an actively exploited vulnerability within 24 hours and know how a security update reaches devices in the field.
Is EN 18031 enough?
EN 18031 covers the requirements of the Radio Equipment Directive that have applied to radio devices since August 2025, and it is a good building block. But it does not automatically replace CRA proof.
The CRA covers all elements of the radio requirements and additionally requires a software bill of materials, vulnerability management, coordinated disclosure, reporting and a support period of at least five years. Your existing evidence can be mapped to Annex I Part I of the CRA. In the Deep Dive we check which gaps remain.
Is ISO 27001 enough?
It helps with the processes in your organization but does not replace evidence on the product.
The CRA requires evidence for the device itself, such as a software bill of materials, security updates and technical documentation. That is why the gap list in the Deep Dive separates organization and device.
What applies to open-source components?
As the manufacturer you carry the due diligence for all third-party components in the product, including open source. They belong in the software bill of materials, because every third-party component brings its own vulnerability risk and its own update path.
The support period of chip manufacturers can also be shorter than the lifetime of your device. Which special rules apply to open-source projects themselves, we classify for your case in the Deep Dive.
Do we need a testing body?
In the standard class, self-assessment is enough: You assess conformity yourself and declare it. For Class I products without a harmonized standard, a notified body effectively becomes necessary.
Which class applies to your product and where standards and notified bodies stand, we clarify in the Deep Dive.
What does the CRA Deep Dive cost?
The Deep Dive has a fixed price that we name in the first call. What the implementation costs depends on the gaps and can be estimated after the Deep Dive.
The effort varies a lot, depending on whether your wireless device already has evidence or is purely wired.
Request
Tell us briefly what you are working on. We will get back to you with a proposed date for the CRA Deep Dive.
The Deep Dive does not replace legal advice. The manufacturer declares conformity themselves.
1. We will get back to you shortly.
2. Initial call 15 to 30 minutes, no sales pressure.
3. A proposal for the next step, or an honest no.
Please don't send anything confidential. IOX GmbH, Cologne, is responsible for this form. More in the privacy policy.