CRA for EU SMEs

Does your product contain software and connect to anything? Then the EU Cyber Resilience Act applies to you, and part of it already does. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours. From December 2027, connected products sold in the EU must meet binding security requirements and carry a CE mark that covers cybersecurity. Fines reach 15 million euros or 2.5 per cent of worldwide turnover. Most CRA guidance is written for lawyers or for large companies with compliance departments. This book isn't. It is written for the small manufacturer with a few engineers, one or two people in IT and a product that happens to have software in it. Following one fictional company, a 40-person maker of electric car chargers, through every step, you will learn: - how to tell whether your products are covered, and what your role is - how to classify products and when you need a notified body - what secure by design means in practice, and how to run a first gap check - how to set a support period, build an SBOM and handle vulnerabilities - how to report to ENISA within 24 hours, and how the CRA overlaps with NIS2 and GDPR - how to manage suppliers, subcontractors and open source - the most common pitfalls and how to avoid them - a three-phase roadmap tied to the regulation's own deadlines Includes checklists, a vulnerability disclosure policy template and reporting templates you can adapt. Håkan Puusepp is an IT manager in the manufacturing industry with more than 25 years of experience in IT, and the founder of Nisenta, a compliance platform for NIS2, GDPR and the CRA. Book 2 of The EU Compliance Series: practical guides to NIS2, the CRA, GDPR and the AI Act for smaller organisations.