Don’t Lose Access to the EU Market
in 2026

Yes. The CRA applies to every product with digital elements made available on the EU market, regardless of where the manufacturer is established (Article 2(1)). A non-EU manufacturer must have at least one EU-established economic operator responsible for the product: an EU-based importer, an authorised representative with a written mandate (Article 18), or a fulfilment service provider where no other operator exists. The non-EU manufacturer remains legally responsible for the product’s compliance.

It depends. Genuine community open-source software supplied without commercial intent is out of scope. OSS is treated as commercial, and therefore in scope, if it is charged for, monetised indirectly through a platform that sells other services, conditioned on personal-data processing for purposes beyond security or interoperability, or funded by donations exceeding development costs (Article 3(22), Recital 15). When a manufacturer integrates open-source components into a commercial product, the manufacturer remains responsible for those components under the CRA, including SBOM coverage and vulnerability handling.

Article 64 sets three tiers of maximum administrative fines.

• Up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher, for breaches of the essential cybersecurity requirements in Annex I and the manufacturer obligations in Articles 13 and 14.
• Up to EUR 10 million or 2% of worldwide turnover for breaches of procedural obligations.
• Up to EUR 5 million or 1% of worldwide turnover for supplying incorrect or misleading information to notified bodies or market surveillance authorities.

The CRA applies a risk-based regime that determines which conformity assessment route a manufacturer must take.

• Default products (the majority in scope) can be self-assessed.
• Important products are listed in Annex III: Class I (password managers, operating systems, routers, SIEMs) can self-assess only with full application of harmonised standards, while Class II (firewalls, hypervisors, industrial intrusion detection systems) always requires a notified body.
• Critical products in Annex IV (smart cards, smart meter gateways, hardware devices with security boxes) require certification under a European cybersecurity certification scheme such as EUCC.

Attestra is rolled out in a deliberate sequence aligned to the CRA’s regulatory deadlines. Module 1, Vulnerability & Incident Reporting, is live now, ahead of the 11 September 2026 Article 14 deadline. The remaining modules follow through 2026 and into 2027: Risk Assessment (Q3 2026), Product Testing (Q4 2026), Documentation & Attestation (Q4 2026), and Product Maintenance (Q1 2027). The September 2026 reporting obligations apply to every CRA-scope product including those already on the market (Article 69(3)), so Vulnerability Handling is the most urgent module to have in place first.

The CRA’s Article 14 reporting obligations begin on 11 September 2026, with 24-hour, 72-hour, and 14-day deadlines, and apply to every product in scope including those already on the market. Attestra provides a structured workflow for receiving, tracking, assessing, and reporting vulnerabilities, so your team has a defined process in place before the deadline rather than improvising one under pressure. The platform captures the information each notification stage requires, maintains a complete audit trail, and routes notifications to the CSIRT designated as coordinator and to ENISA via the single reporting platform.

Yes. Most CRA-scope manufacturers are not security companies. They are SMEs, embedded systems teams, hardware companies, and OEMs whose engineers know their product inside out but have never had to navigate EU cybersecurity regulation. Attestra’s AI-guided workflows translate the CRA’s obligations into concrete, sequential tasks your existing team can work through, while the Attestra Academy supplies the underlying cybersecurity and regulatory knowledge as your team needs it. Decision-making stays in-house, your team’s internal expertise builds with each product update, and your dependence on expensive external consultants reduces.

Yes. Attestra is purpose-built to help manufacturers prepare the product security evidence required for CRA conformity assessment and CE marking. The platform structures the cybersecurity risk assessment (Article 13), the technical file (Article 31, Annex VII), the EU Declaration of Conformity, the SBOM (Annex I Part II), the support period statement, vulnerability handling records, and instructions to the user (Article 16). Whichever conformity assessment route applies, Attestra structures the evidence trail so it can be presented to your internal team, a notified body, or a certification scheme.

The Design Partner Program is open to digital product manufacturers preparing for the EU Cyber Resilience Act, particularly teams whose products fall under the September 2026 vulnerability reporting deadline. Specific eligibility criteria and current cohort availability are confirmed during the application process.

The Program is supported by the European Union’s Digital Europe Programme through the CRA-AI project, led by Cyber Cert Labs. Specific Design Partner terms and commercial details are confirmed during the application process.

Design Partners get hands-on support from the Attestra team, early access to each module as it ships, and matching Attestra Academy training so their team builds CRA expertise in-house. The Program is designed to fit around the working week of product and engineering teams already preparing for compliance.

All data and history captured during the pilot remains in your account: product registrations, risk assessments, vulnerability records, technical documentation, and audit trails. The cybersecurity expertise built through the Attestra Academy stays with your team. Specific commercial terms for continued access beyond the Design Partner phase are confirmed during the Program.