The Cyber Resilience Act makes security mandatory for all products with digital elements sold in the EU. That includes connected devices and software, including software companies run on their own servers. Manufacturers must develop their products securely, fix vulnerabilities and report them.
For software this is new. Until now there were no EU-wide mandatory rules for the security of software you buy. Since September 2026 the first stage, the reporting duty, has been running. From December 2027 the CRA applies in full.
- The Cyber Resilience Act (Regulation (EU) 2024/2847) sets minimum security standards for software and connected devices sold in the EU, across their whole life cycle.
- Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe security incidents within 24 hours; from 11 December 2027 the requirements for development, updates, documentation and CE marking apply too.
- The duties lie with the manufacturer, not with the company using the software, but as a buyer you should ask about them specifically.
What is the Cyber Resilience Act?
The CRA is Regulation (EU) 2024/2847. It works like other EU product laws: the manufacturer checks whether its product meets the requirements, keeps technical documentation and affixes a CE mark. What's new is that this also applies to software and over the product's whole lifetime.
The CRA entered into force on 10 December 2024 and applies in stages. The graphic above shows the deadlines. Products placed on the market before December 2027 only fall under the full duties if they're substantially modified. The reporting duty, however, applies to all products on the market.
In shortProduct law for software and devices: develop securely, fix vulnerabilities, CE mark.
Who does the CRA cover?
The duties lie with those who place a product on the EU market: manufacturers, importers and distributors. The manufacturer carries most of them. Companies that only use software have no duties of their own under the CRA.
With software, it depends on how it's delivered:
Software you run yourself
- Counts as a product with digital elements.
- Falls under the CRA; the manufacturer carries the duties.
- You get updates and security information from the manufacturer.
Pure cloud service
- Usually doesn't count as a product placed on the market.
- Mostly falls under the NIS2 rules for services instead of the CRA.
- Exception: the remote processing is part of a product that doesn't work without it.
With open source, what counts is whether money is involved. Free software that its maker doesn't sell commercially is exempt. Foundations that look after such software over time have lighter duties as "stewards". Anyone who sells a product with an open core, on the other hand, is a manufacturer, whatever the licence.
In shortManufacturers carry the duties; self-hosted software yes, pure cloud services mostly not.
The reporting duty since 11 September 2026
Since 11 September 2026, manufacturers must report two kinds of events: vulnerabilities that are known to be exploited, and severe incidents that affect the product's security. The deadlines run from the moment the manufacturer becomes aware:
- Early warningwithin 24 hours
- Notificationwithin 72 hours, with an initial assessment
- Final report, vulnerabilityno later than 14 days after a fix is available
- Final report, incidentwithin one month of the 72-hour notification
Reports go through the EU's single reporting platform, run by ENISA. The report goes first to the responsible national computer emergency team. In Germany, under the draft implementation act, the BSI is to take on market surveillance. Manufacturers also inform affected users and say what they can do.
In short24 hours, 72 hours, 14 days or one month: via the EU reporting platform.
The duties from December 2027
From 11 December 2027, products must meet the essential requirements in Annex I. They fall into two parts:
- Product properties: securely developed, shipped without known exploitable vulnerabilities, with secure default settings and protection of data and access.
- Vulnerability handling: a bill of materials for the software components (SBOM), fast and free security updates, a process for reporting vulnerabilities and a point of contact.
The manufacturer sets a support period and states its end date at purchase. It should be at least five years, unless the product is used for less. For most products a self-assessment is enough. "Important" and "critical" products, such as operating systems or firewalls, need stricter procedures.
Due diligence on third-party components comes on top. Modern software consists largely of open-source libraries. The manufacturer must check that these components don't put security at risk, and treat vulnerabilities in them just like those in its own code. With AI platforms, this also covers components for search, the database and running models. At the end come technical documentation and an EU declaration of conformity.
In shortFrom December 2027: secure products, SBOM, updates, support period, CE.
What the CRA means for buyers of AI software
As a company that uses software, you have no CRA duties. But you benefit if you ask the right questions. With AI platforms that can access many documents, it's especially worth it:
Every point ticked. Well prepared.
Similar questions are worth asking about cloud services, even though the CRA mostly doesn't apply there. Laws such as NIS2 and your own contract then govern security.
In shortNo duties of your own, but five questions for every vendor.
What applies to RAGSuite
Because RAGSuite is also offered for self-hosting, it falls under the Cyber Resilience Act. NITSAN GmbH is the manufacturer. For actively exploited vulnerabilities and severe security incidents, we meet the reporting duties that have applied since 11 September 2026.
We're working towards the essential requirements that apply from December 2027. We only list a capability in the Trust Center once it has shipped. We don't claim CRA conformity or CE marking today. You can report a vulnerability via security disclosure. Technical background is on the page RAGSuite for developers.
This is general information, not legal advice. Have your legal or IT security team assess your specific situation.
In shortRAGSuite falls under the CRA; we report, work towards the requirements and only list what has shipped.
See how RAGSuite handles security, updates and reporting in the Trust Center, or talk your questions through with Stefan.
Frequently asked questions
What is the Cyber Resilience Act?
The Cyber Resilience Act is EU Regulation 2024/2847. It sets minimum security standards for products with digital elements, meaning connected devices and software sold in the EU. Manufacturers must develop securely, fix and report vulnerabilities and, from December 2027, affix a CE mark to show their product meets the requirements.
When does the Cyber Resilience Act apply?
The CRA has been in force since 10 December 2024 and applies in stages. Since 11 September 2026 the reporting duties for actively exploited vulnerabilities and severe incidents apply, including to products already on the market. From 11 December 2027 all remaining duties apply.
Does the CRA apply to open-source software?
Free software that its maker doesn't sell commercially is exempt. Foundations that look after such software over time have lighter duties as stewards and face no fines. Anyone selling a product with an open core, on the other hand, counts as a manufacturer and carries the full duties, regardless of the licence.
Does the Cyber Resilience Act apply to SaaS and cloud services?
Usually not. Pure cloud services generally don't count as products placed on the market and tend to fall under NIS2 instead. One exception is remote processing without which a product doesn't work. Software you run yourself, by contrast, does fall under the CRA.
What do companies that only use software have to do?
They have no duties of their own under the CRA; those lie with the manufacturer. Still, it makes sense to ask when buying: about the end date for security updates, the contact point for vulnerabilities, the bill of materials and how you'll hear about updates. Also check your own duties, for example under NIS2.
Sources
- Cyber Resilience Act, Reg. (EU) 2024/2847: Annex I
- European Commission: Cyber Resilience Act: summary: scope, deadlines
- ENISA: Factsheet zur CRA-Meldeplattform (September 2026): reporting deadlines and route
- IHK Nürnberg: CRA: Meldepflichten ab 11. September 2026: overview for companies
- ZVEI: Position zum Referentenentwurf CRA-Durchführungsgesetz (April 2026): BSI as market surveillance (draft)
Stefan works with customers in public administration and regulated industries. He writes about the GDPR, the EU AI Act, works councils and tenders.