The EU Cyber Resilience Act is no longer a distant proposal - it is in force, with hard deadlines and significant penalties. These are the numbers every manufacturer of connected products should plan around.
Source: European Commission - Cyber Resilience ActCRA Compliance
The Cyber Resilience Act (CRA) is EU regulation that sets cybersecurity requirements for products with digital elements - software, firmware and connected hardware sold in the EU. It requires measures such as a Software Bill of Materials (SBOM), at least five years of security updates, coordinated vulnerability disclosure, secure-by-default design and CRA-compliant CE marking.
If you make or sell connected products in the EU, CRA compliance becomes a condition for staying on the market. Getting ahead of it protects your revenue, your reputation and your release schedule - instead of scrambling before the 2027 deadline.
CRA vs NIS2
Both are EU cybersecurity regulations, but they target different things. The CRA governs the security of products with digital elements, while NIS2 governs the cybersecurity of organisations that operate essential and important services. Many Danish businesses fall under both.
| Aspect | Cyber Resilience Act (CRA) | NIS2 Directive |
|---|---|---|
| Primary focus | Security of products with digital elements | Cybersecurity of essential & important entities |
| Who it applies to | Manufacturers, importers & distributors of digital products | Operators of essential and important services |
| Core obligation | Secure-by-design, SBOM, 5 years of updates, CE marking | Risk management, governance & incident reporting |
| Reporting deadline | 24h early warning for exploited vulnerabilities | 24h early warning for significant incidents |
| Key date | Full application from 11 Dec 2027 | National transposition due since 17 Oct 2024 |
| Maximum penalty | €15M or 2.5% of global turnover | €10M or 2% of global turnover |
From hands-on CRA consulting to leadership guidance, training and product integration - we help you build compliance that fits how your business already works.
Hands-on CRA scoping, gap analysis and prioritised roadmaps that map directly onto your products and release cycle.
Read moreStrategic guidance for founders and leadership teams - clear decisions on risk, investment and compliance ownership.
Read morePractical upskilling so your teams understand CRA obligations and can sustain secure practices day to day.
Read moreIntegrating SBOM, vulnerability handling and secure update tooling into your product stack without slowing delivery.
Read moreAnswer a short questionnaire to see how the CRA applies to your product.
Get your CRA AssessmentFAQ
The Cyber Resilience Act (CRA) is EU regulation that mandates cybersecurity requirements for products with digital elements. It covers software, firmware, and connected hardware sold in the EU, requiring measures such as a Software Bill of Materials (SBOM), at least five years of security updates, coordinated vulnerability disclosure, secure-by-default design, and CRA-compliant CE marking.
The CRA generally applies if your product connects to another device or network (Wi-Fi, Bluetooth, USB, or API), is software or firmware sold commercially, is a hardware component used inside a connected product, or connects indirectly as part of a larger connected system. Products already regulated as medical devices, vehicles, aviation, or marine equipment are typically out of scope.
SPS Digital Tech helps Danish companies navigate CRA compliance from scoping to certification. This includes a discovery audit to identify security gaps and CRA misalignments, a custom security blueprint, and deployment oversight to reach a fully compliant, CE-markable state.
SPS Digital Tech focuses on EU Cyber Resilience Act (CRA) compliance: scoping and gap analysis to determine whether your products are in scope, secure-by-design engineering and Software Bill of Materials (SBOM) management, coordinated vulnerability handling with 24-hour incident reporting, and technical documentation and conformity assessment for CRA-compliant CE marking. Engagement models range from a complimentary strategic discovery session to deployment oversight, an ongoing compliance programme lead, and ad-hoc audit and reporting support.
SPS Digital Tech was founded by Stephan Smuts, a Strategic Security Architect who combines elite international expertise with a deep understanding of the Danish market to deliver practical, high-integrity security solutions.
Facilitating the implementation of secure and compliant business operations.
Get your CRA Assessment