As digital products become increasingly connected, cybersecurity is no longer optional, it is a business necessity. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes common cybersecurity requirements for products with digital elements across the European Union.
By introducing security-by-design principles, vulnerability management obligations, and greater transparency for users, the CRA aims to strengthen the resilience of the EU’s digital ecosystem. While the Regulation will become fully applicable from 11 December 2027, key obligations start earlier, making it essential for manufacturing SMEs to begin preparing now. To help businesses better understand the new requirements, MANTRA has gathered insights from cybersecurity experts across Europe.
Acknowledgements: MANTRA would like to thank CyberStand and Cyber Cert Labs for contributing their expertise and practical insights to this article. Their perspectives help clarify the implications of the Cyber Resilience Act for manufacturing SMEs and provide concrete guidance on how organisations can begin their compliance journey.
The Cyber Resilience Act is reshaping the way digital products are designed and managed. What should manufacturing SMEs know about the regulation, and why is it important to start preparing now?
CyberStand: Manufacturing SMEs should understand that the Cyber Resilience Act introduces cybersecurity requirements for hardware and software placed on the EU market. It covers product security throughout the lifecycle, meaning products must be designed, updated and maintained with cybersecurity in mind. Preparing now is important because compliance is not only a final certification exercise. It may require changes to product development, risk assessment, vulnerability handling, technical documentation and post-market support. For SMEs, the practical first step is to identify which products are in scope, assess existing cybersecurity processes and follow the Commission’s guidance and the development of harmonised standards. These standards are intended to support implementation and help manufacturers demonstrate conformity with the CRA’s requirements.
Cyber Cert Labs: The most important thing to understand is how broad the CRA is: it applies to virtually any product with digital elements placed on the EU market, from connected machinery and industrial sensors to consumer devices and software, and the CE mark elevates cyber security to a health and safety issues by linking it to the New Legislative framework. Manufacturers must build products that are secure by design, manage vulnerabilities throughout a defined support period, and provide users with security updates and clear information. The reason to start now is the timeline. While the regulation applies in full from 11 December 2027, the vulnerability and incident reporting obligations apply from 11 September 2026, which means manufacturers need working processes to detect, assess and report actively exploited vulnerabilities and severe incidents to the authorities within tight deadlines, starting with a 24 hour early warning. Those processes, and the design, documentation and testing work behind full compliance, take months to put in place, so an SME that starts in 2027 has already left it too late.
What are the biggest challenges or misconceptions that manufacturing SMEs face when approaching CRA compliance?
CyberStand: The biggest challenge is often treating CRA compliance as a one-off certification exercise. In reality, the CRA covers cybersecurity throughout the product lifecycle: products must be designed, updated and maintained with security in mind. Another misconception is that compliance is mainly an IT responsibility. It also affects product development, risk assessment, technical documentation, vulnerability handling and post-market support. For SMEs, the key difficulty is therefore integrating these requirements into existing engineering and business processes without creating unnecessary complexity. Finally, many companies assume they should wait until every harmonised standard is available. Standards will be important because they can provide practical guidance. However, SMEs can already start by mapping products in scope, clarifying internal responsibilities and reviewing their current security and vulnerability-management processes.
Cyber Cert Labs: The most common misconception is that the CRA does not apply to them, because they see themselves as a manufacturer of pumps, sensors or safety equipment rather than a technology company or they do not see themselves as a manufacturer for instance a company with a phone app is in scope. The second is assuming existing work already covers it: companies with EN 18031 conformity under the Radio Equipment Directive, or an ISO 27001 certificate, often believe they are done, while some security schemes are helpful, they do not provide full coverage, and our gap analysis consistently shows additional CRA obligations around vulnerability handling, support periods and reporting. Third, many treat the CRA as a documentation exercise to complete before shipping, when it is really a set security processes and tasks that need to be embedded into your manufacturing or product development process and they need to continue for the life of the product. Finally, some SMEs are waiting for the harmonised standards to be finalised before acting. We contributed directly to CEN and CENELEC JTC 13 Working Group 9 where those standards are being developed, and our clear advice is not to wait: the draft standards already show the direction of travel and can be used to build compliance evidence today.
Many SMEs believe compliance is expensive and complex. What free or accessible tools, training resources, standards, or support initiatives already exist to help them?
CyberStand: There are already several accessible forms of support. The European Commission provides a dedicated CRA implementation website, FAQs and practical guidance, including examples specifically designed to make compliance clearer and more proportionate for SMEs. ENISA has also published a free SME Cyber Resilience Maturity Assessment Model, which companies can use to assess their current practices, identify gaps and prioritise improvements. Its European Vulnerability Database provides reliable information on known vulnerabilities, mitigation measures and exploitation status. In addition, several EU-funded projects are developing practical tools, training and guidance specifically for SMEs. For example, OSCRAT is building an open-source, freely accessible tool to help European companies assess their cybersecurity systems in compliance with CRA provisions. CRA-AI is developing three solutions: Attestra, an AI-native product security and compliance platform purpose-built for CRA conformity; Attestra Academy, an online CRA training programme for product owners, engineering, and compliance teams; and PinSpot, covering vulnerability management, penetration testing, and secure code analysis, with API integration into Attestra. The SECURE project has developed guidelines to help SMEs understand CRA obligations, essential cybersecurity requirements, and a methodological compliance framework, along with a CRA maturity score tool and video lessons and training. The key message is that SMEs do not need to build their compliance approach from scratch. They can already use public guidance, assessment tools, training and EU-supported initiatives to begin preparing in a structured and proportionate way.
Cyber Cert Labs: There is more support available than most SMEs realise, much of it EU funded, and in some cases, there is direct money specifically for the CRA implementation. The EU-funded SECURE project provides cascade funding of up to €30,000 per company to co finance CRA compliance work: its first open call ran in early 2026 and further calls are expected in autumn, so SMEs should register their interest at secure4sme.eu now to be ready for the next window. Notably, SECURE rewards proposals that make use of tools from other EU CRA projects, which is exactly what CRA-AI provides. Through CRA-AI, co funded by the Digital Europe Programme, we offer a free CRA readiness assessment and scope assessment so any company can establish in minutes whether the CRA applies to its products and where it stands today, plus a free webinar series, with a new series launching in September 2026 covering real case studies, and our EU wide SME market maturity scan. Attestra, our AI powered product security and compliance platform, is live now focused first on the September 2026 reporting obligations, and Attestra Academy provides fully online training built around ten modules covering all the CRA requirements. Beyond that, ENISA and the European Commission publish guidance on scope and reporting, the draft harmonised standards give a clear technical direction, and the National Coordination Centres in each member state can point SMEs to national support.
If you could recommend just three practical actions that an SME should take today to begin its CRA journey, what would they be?
CyberStand: First, map your product portfolio. Identify which hardware, software and components may fall within the CRA, determine your role in the supply chain, and check whether any products belong to an important or critical category. Second, carry out a cybersecurity risk assessment for one priority product. Review how security is addressed across design, development, production and maintenance, and document the main risks, existing controls and gaps. The European Commission identifies risk assessment as the manufacturer’s first step. Third, establish a basic vulnerability-handling process. Assign responsibilities, create a channel for receiving vulnerability reports, define how issues will be assessed and corrected, and prepare for the CRA reporting obligations. The objective is not to complete compliance immediately, but to understand the scope, identify the most significant gaps and put clear ownership in place.
Cyber Cert Labs: First, scope and classify your product portfolio: establish which products are in scope of the CRA and whether they fall into the default, important or critical category, because everything else, from the applicable requirements to the type of conformity assessment, flows from that answer, and a free scope assessment makes this a fast exercise. Second, prepare for the reporting obligations that arrive on 11 September 2026: put a vulnerability intake and triage process in place now and make sure someone in the business knows how to make the required notifications within the 24 hour early warning deadline. Third, run a gap analysis of your current security and conformity work against the CRA essential requirements, using your existing RED, EN 18031 or quality system work as the baseline, so you turn a regulatory worry into a concrete, costed plan, and train your team so the knowledge sits inside the business rather than with an external consultant.
Contributors: Luigi Colucci; Project manager Trust-IT Services S.r.l.; Conor McGoveran CPO and Co-Founder, Cyber Cert Labs, coordinator of the EU funded CRA-AI project (Digital Europe Programme); Patricia Shields CEO and Co Founder, Cyber Cert Labs, coordinator of the EU funded CRA-AI project (Digital Europe Programme).
September 2026
