EU CYBER RESILIENCE ACT · FOR MAKERS OF CONNECTED PRODUCTS

Your product contains software. Since 11 September 2026, the EU gives you 24 hours.

The Cyber Resilience Act is a new EU law for products that contain software, exchange data with a device or network and are sold in the EU. Swiss manufacturers included. Products you sold years ago included. Once you become aware that a flaw in your product is being actively exploited, you have 24 hours to send an early warning to the national CSIRT. We make sure you can.

What the law requires once you become aware that a flaw in your product is actively exploited

24h

Early warning to the national CSIRT

72h

Vulnerability notification

14d

Final report, 14 days after a fix is available

TALK TO AN ENGINEER

DOWNLOAD FREE SELF CHECK

Never heard of it? Start here

The CRA in Three Sentences

It is a law, not a standard.

Regulation (EU) 2024/2847, the Cyber Resilience Act. It entered into force in December 2024. Its first duty, reporting, applies since 11 September 2026. The full set of requirements applies from 11 December 2027. There is no opt-in and no certificate to buy your way out.

It applies to you if three things are true.

Your product contains software. It can exchange data with something, even indirectly: a network, Bluetooth, USB, a phone app, a cloud. It is sold in the EU, under your name. Where your company sits does not matter: a Swiss manufacturer is fully in scope.

It asks four things of you.

Know what software is inside every release you ship. Watch for known flaws in it. Fix them and ship the fix. Send an early warning within 24 hours of becoming aware that a flaw in your product is being actively exploited. Keep watching and fixing for the support period, normally at least five years; reporting continues after it. Products placed on the market before 11 December 2027 carry the reporting duty only; every unit placed from that date carries all four.

Where the law stands today

What we offer

Three Steps, from “Where Do We Stand” to “We Are Covered”

Built for manufacturers whose firmware is made by a handful of engineers, not by a security department. The pressure rarely arrives as a regulator’s letter. It arrives as a customer’s purchase order asking for proof.

1 · Free · one hour · you do it

Check Yourself

Ten questions, scored honestly by you, nothing to send back and no obligation. You see where you stand today. We ran it on our own product first and scored 2 out of 10.

DOWNLOAD SELF CHECK

2 · Fixed price· two weeks · we do it

Let Us Measure

The readiness check. We measure your real build against the ten capabilities the law quietly assumes, with evidence, not with a questionnaire. You get a scored report, the EU reporting platform walked through with your people, and a gap plan your own team can act on.

How it works
Day 1You give us read access to one or two shipped releases and their build.
↓
Days 2 to 8We open the software list of each release, rebuild one, and test each of the ten capabilities against what we actually find. Where the documentation says one thing and the binaries say another, the binaries win.
↓
Days 9 to 12Scored report, one page per capability, evidence attached. The EU reporting platform walked through, EU Login accounts ready, and which national CSIRT is yours.
↓
Day 14One-hour debrief with management: the score, the three things to fix first, and what each costs.
Why not just the self-check? In our own dry run the documentation said a software list existed. It did not. A self-check is answered with intention; the readiness check is answered with evidence.

3 · Monthly · per product · we keep doing it

Stay Covered

The ongoing watch. We archive the software list of every release you ship and check it every night against the live vulnerability databases, with a separate watch for flaws under active attack. When something turns up, a named person on your side hears about it, with our verdict and, where it matters, the early warning already drafted.

How the watch works
Every release you shipSoftware list archived, per version.
↓
Every nightCompared with the live vulnerability databases.
Plus a separate watch for flaws under active attack.
↓
Every match gets a written verdict“Not affected, because” or “affected, fix scheduled”. A reachable flaw on the exploited list goes to the top of the queue.
↓
Fix built, warning draftedThe update is built and tested on your hardware. The early warning is written before anyone asks for it. A voluntary report, if it helps the CSIRTs.
↓
Evidence about one of your devicesFrom a CSIRT, a customer or your own logs, it reaches the named person on your side, who checks it at once. Once you are reasonably sure it is being exploited, the draft becomes the early warning: you file it within 24 hours, then the 72-hour notification and the final report, and you tell affected users. We stand next to you.
A flaw on the exploited list is not a report by itself. The clock starts when a prompt first look at the evidence makes you reasonably sure it is being exploited in your product. That is when the preparation pays.

Honest scope

Detection runs every night, unattended, weekends included; expert analysis is business hours. You remain the manufacturer and the filing stays yours, with our draft in hand. The reporting duty does not end with your support period, and the law sets no end date; neither does the watch.

Why EDGEMTech

Why an Embedded Software Company, and not a Law Firm or a Scanning Tool

We build this kind of firmware every day.

Yocto Linux, real-time systems, Toradex and similar modules, chip-vendor Bluetooth stacks. The CRA is a question about what is inside your build. That is where we live.

Tools give findings. Reporting needs judgment.

A scanner lists hundreds of matches and decides nothing. Someone has to say “this one does not affect us, because” and write down why. That judgment is the service.

The final report needs a fix that boots.

The final report is due no later than 14 days after a fix is available, and it has to describe that fix. A fix that runs on hardware sold five years ago is engineering work, not paperwork. We do that work.

The radio stack in your product comes from the chip vendor. The reporting duty stays with you, the manufacturer.

Frequently Asked Questions

We are a Swiss company. Does an EU law really apply to us?
Yes. The duties attach to the manufacturer, the company whose name or trademark is on the product, wherever it sits, as soon as the product is sold in the EU, directly or through an EU importer. From 11 December 2027 your EU importers and distributors must also check your CE marking and papers before selling new units, so the question will reach you through them too. With no establishment in the EU, you report to the national CSIRT of the EU country where your authorised representative sits; failing that, where the importer, then the distributor, that sells most of your products sits; failing that, where most of your users are (Article 14(7)). Switzerland is preparing its own law modelled on the CRA: the Federal Council wants a draft for consultation by June 2027.
We sold the product years ago. Does the CRA apply to it too?
For reporting, yes. The reporting duty covers every product you have placed on the EU market that falls under the CRA, including models you no longer sell, and it does not end when your support period ends. The design and fixing duties are different: they apply to units you place on the market from 11 December 2027, and to older products only if you substantially modify them after that date. A security update is usually not a substantial modification; a change that adds risks, or changes what the product is for, usually is.
If we launch before December 2027, do we avoid the full CRA requirements?
Only for the units that reach the EU market before that date. “Placed on the market” counts each unit, not the model. Units of the same product supplied from 11 December 2027 onward must comply in full: secure design, software list, fixing duty, support period, CE marking. A launch in November 2027 protects the units already supplied and nothing else. Stand-alone software is the exception: a version counts as placed when it is first offered, and later copies of that same version go with it.
Our Bluetooth or Wi-Fi stack comes from the chip vendor. Is that their problem?
We already have CE marking. Is this not covered?
Partly. If your product has a radio and can reach the internet, even through a phone or a gateway, its CE marking has had to cover some cybersecurity since 1 August 2025, under the Radio Equipment Directive (so have radio toys, childcare products and wearables that handle personal data). From 11 December 2027 the CRA takes over, and CE marking on every new unit means CRA compliance. Neither covers the reporting duty: that applies now, CE marked or not.
Is the self-check not enough?
A library we use is on the “exploited in the wild” list. Must we report within 24 hours?
Not by itself. The Commission’s July 2026 guidance interprets the duty narrowly: a vulnerability counts as actively exploited for reporting purposes only when there is reasonable certainty that it is being exploited in your product. If the vulnerable code is not reachable, or there is no evidence that anyone has attacked your product through it, there is no mandatory report. You should still fix the vulnerability, and for units placed on the market from 11 December 2027, the law requires you to do so. You may also report it voluntarily.
The 24-hour period begins when a prompt review of evidence about your own devices makes you reasonably certain that the flaw is being exploited in them.
What happens if we do nothing?
Fines, set by each EU country, can reach 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher. Micro and small companies cannot be fined for a late 24-hour early warning, but can be for the rest. From 11 December 2027, authorities can also have a product withdrawn or recalled.
In practice the first pressure is quieter: a customer’s purchase order asking for your software list and your security contact.
Do you take over the reporting for us?

Thirty minutes with an engineer, not a sales call.

Bring one product. We tell you which of the ten capabilities you already have, which you do not, and whether the readiness check is worth your money.

TALK TO AN ENGINEER

DOWNLOAD SELF CHECK

A summary of the regulation as we read it, not legal advice.