Skip to main content

← Back to glossary

Term · 28. International Regulations

EU CRA (Cyber Resilience Act) CRA

Law Source: EU CRA
Personal Data Identity Security Standards CRA

Definition

EU regulation (Regulation (EU) 2024/2847; in force 10 Dec 2024) imposing cybersecurity requirements on products with digital elements (PDE) — covering software, hardware, IoT, and digital services placed on the EU market. Requires secure-by-design development, vulnerability handling, vulnerability/incident reporting to ENISA (early warning within 24 hours) from 11 Sep 2026, and CE marking; main obligations apply from 11 Dec 2027. Identity products and IAM platforms fall under CRA scope.

Synonyms
  • Regulation (EU) 2024/2847
Application
Affects manufacturers, importers, and distributors of products with digital elements sold in the EU. IDM/IAM vendors must demonstrate secure default configurations, vulnerability disclosure programs, security update mechanisms, and SBOM (Software Bill of Materials) documentation.
Sources

Related terms

← Back to glossary  ·  Open in main list