Notes on the Cyber Resilience Act
Short and practical. What the regulation asks, what to do about it, with the article references. Written by the person who built the kit.
Guides by ecosystem
Does the CRA apply to Home Assistant integrations?
HACS, core or add-on: which Home Assistant authors are CRA manufacturers, what Article 14 asks since 11 September 2026, and five things to do this week.
Does the CRA apply to my VS Code extension?
Free, freemium or company-backed: which VS Code extension authors are CRA manufacturers, what Article 14 asks since 11 September 2026, and what to do this week.
Is my WordPress plugin in scope of the CRA?
Premium, freemium or free: which WordPress plugin authors are manufacturers under the CRA, what Article 14 asks since 11 September 2026, and five things to do this week.
The Cyber Resilience Act is Regulation (EU) 2024/2847. It applies to products with digital elements sold in the European Union: software, firmware, connected devices, and the remote data processing a maker designs for them. Since 11 September 2026, an actively exploited vulnerability in your product has to be reported to your national CSIRT and to ENISA within 24 hours, with a follow-up at 72 hours and a final report later. The rest of the text, the SBOM, the technical documentation, the EU declaration of conformity, the CE marking and five years of support, applies from 11 December 2027.
These notes take one question at a time and answer it with the article that decides it. Who counts as a manufacturer. What a SaaS with a mobile app has to do. How to write a reporting procedure that fits on one page. They are written for teams of two to twenty people who have no compliance department and no legal budget, by the person who built the kit. Nothing here replaces a lawyer on your own situation.
A gateway flaw can start your 24-hour clock
A gateway you didn't build can trigger your Article 14 clock once it's actively exploited and your product sits behind it.
CISA's new KEV entries could start your 24 hours
CISA's KEV catalog only lists confirmed exploitation. A new entry naming a dependency you ship can start Article 14's 24-hour clock today.
Add a security.txt file in ten minutes
RFC 9116 needs three lines. Annex I Part II will require a disclosure contact from 11 December 2027. Here's how researchers use the file.
Your SBOM needs checking after you ship it, not just once
The CISA KEV catalog flags dependencies you shipped that are now under active exploitation, the trigger Article 14 cares about.
A paid tier can make your open source project a manufacturer
A donation-funded library stays out of scope under recital 18, but a paid subscription tier makes its maintainer a manufacturer under Article 3(13).
Selling from outside the EU doesn't exempt you from the CRA
A developer based outside the EU selling to European customers is still a manufacturer under Article 3, with the same 24-hour and 72-hour clocks as anyone in th
The extension store doesn't decide who's the manufacturer
A paid browser extension sold on the Chrome Web Store is still a manufacturer under Article 3(13), no different from selling it yourself.
What your SBOM has to list under the Cyber Resilience Act
Annex I asks for top-level dependencies at minimum, from 11 December 2027. What that means for a solo developer shipping one paid product.
What to tell your users after you notify the CSIRT
Article 14(8) asks you to inform affected users after an actively exploited flaw. What it requires, what it leaves to you, what to draft now.
What the crypto wallet headlines mean for your own app
Crypto wallet makers made the headlines today. The articles of the regulation behind that story, and the three questions that decide for you.
What to have ready before you open ENISA's platform
The Single Reporting Platform went live on 11 September 2026. What Article 14 expects you to produce, with the article behind each piece.
Five cases that decide if the CRA calls you a manufacturer
Freelance work, a free tier, a browser-only SaaS, a repo on GitHub, a non-EU seller. Where the CRA stops, with the article for each answer.
Find the actively exploited flaws in your dependencies
On 11 September the 24 hour clock starts when you know. Here is how to spot an actively exploited dependency in your own project.
Write your 24-hour reporting procedure on one page
Article 14 applies from 11 September 2026. The five lines that say who takes the call, who decides, and where the notification goes.
You run a SaaS and ship an app? The CRA looks at the app
A browser-only SaaS is outside the Cyber Resilience Act. Add a mobile app, a desktop client or a device that needs your servers, and the picture changes. Here is where the line is, with the article references.