EU CYBER RESILIENCE ACT · FOR MAKERS OF CONNECTED PRODUCTS

Your product contains software. Since 11 September 2026, the EU gives you 24 hours.

The Cyber Resilience Act is a new EU law for every product that contains software and is sold in the EU. Swiss manufacturers included. Products you sold years ago included. No exemption for small companies. When a flaw in your product is being actively exploited, you have 24 hours to warn the authorities. We make sure you can.

What the law requires, once a flaw is actively exploited

24h

Early warning to the EU

72h

Full notification

14d

Final report, after the fix

TALK TO AN ENGINEER

DOWNLOAD FREE SELF CHECK (PDF)

Never heard of it? start here

The CRA in Three Sentences

It is a law, not a standard.

Regulation (EU) 2024/2847, the Cyber Resilience Act. It entered into force in December 2024. Its first duty, reporting, applies since 11 September 2026. The full set of requirements applies from 11 December 2027. There is no opt-in and no certificate to buy your way out.

It applies to you if three things are true.

Your product contains software. It can connect to something: a network, Bluetooth, USB, a phone app, a cloud. It is sold in the EU, directly or through a distributor. Where your company sits does not matter: a Swiss manufacturer is fully in scope.

It asks four things of you.

Know exactly what software is inside every version you have shipped. Watch for known flaws in it. Fix them and ship the fix. Report a flaw that is being actively exploited in your product within 24 hours. And keep all of this up for the whole support period of the product, at least five years. Products already in the field carry the reporting duty only; every unit you place on the market from 11 December 2027 carries all four.

Where the law stands today

What we offer

Three Steps, from “Where Do We Stand” to “We Are Covered”

Built for manufacturers whose firmware is made by a handful of engineers, not by a security department. The pressure rarely arrives as a regulator’s letter. It arrives as a customer’s purchase order asking for proof.

1 · Free · one hour · you do it

Check Yourself

Ten questions, scored honestly by you, nothing to send back and no obligation. You see where you stand today. We ran it on our own product first and scored 2 out of 10.

DOWNLOAD SELF CHECK

2 · Fixed price· TWO weeks · we do it

Let Us Measure

The readiness check. We measure your real build against the ten capabilities the law quietly assumes, with evidence, not with a questionnaire. You get a scored report, your registration on the EU reporting platform walked through, and a gap plan your own team can act on.

How it works
Day 1You give us read access to one or two shipped releases and their build.
↓
Days 2 to 8We open the software list of each release, rebuild one, and test each of the ten capabilities against what we actually find. Where the documentation says one thing and the binaries say another, the binaries win.
↓
Days 9 to 12Scored report, one page per capability, evidence attached. Registration on the EU reporting platform walked through, and which national agency is yours.
↓
Day 14One-hour debrief with management: the score, the three things to fix first, and what each costs.
Why not just the self-check? In our own dry run the documentation said a software list existed. It did not. A self-check is answered with intention; the readiness check is answered with evidence.

3 · Monthly · per product · we keep doing it

Stay Covered

The ongoing watch. We archive the software list of every release you ship and check it every night against the live vulnerability databases, with a separate watch for flaws under active attack. When something turns up, a named person on your side hears about it, with the notification already drafted.

How the watch works
Every release you shipSoftware list archived, per version.
↓
Every nightCompared with the live vulnerability databases.
Plus a separate watch for flaws under active attack.
↓
Every match gets a written verdict“Not affected, because” or “affected, fix scheduled”. A reachable flaw on the exploited list goes to the top of the queue.
↓
Fix built, warning draftedThe update is built and tested on your hardware. The early warning is written before anyone asks for it. A voluntary report, if it helps the CSIRTs.
↓
Evidence about one of your devicesFrom a CSIRT, a customer or your own logs, it reaches the named person on your side. The draft becomes the early warning. You file within 24 hours. We stand next to you.
A flaw on the exploited list is not a report by itself. The clock starts with evidence about your product, and that is when the preparation pays.

Honest scope

Detection runs around the clock; expert analysis is business hours. You remain the manufacturer and the filing stays yours, with our draft in hand. The reporting duty lasts as long as your product is in use, and does not end with your support period; neither does the watch.

Why EDGEMTech

Why an Embedded Software Company, and not a Law Firm or a Scanning Tool

We build this kind of firmware every day.

Yocto Linux, real-time systems, Toradex and similar modules, chip-vendor Bluetooth stacks. The CRA is a question about what is inside your build. That is where we live.

Tools give findings. The law needs verdicts.

A scanner lists hundreds of matches and signs nothing. Someone has to say “this one does not affect us, because” and put their name under it. That judgment is the service.

The final report needs a fix that boots.

Within 14 days you must report what you did about it. A fix that runs on hardware sold five years ago is engineering work, not paperwork. We do that work.

The radio stack in your product comes from the chip vendor. The reporting duty stays with you, the manufacturer.

Frequently Asked Questions

We are a Swiss company. Does an EU law really apply to us?
Yes. The duties attach to whoever places the product on the EU market, wherever that company sits. Your EU importers and distributors must also check that you comply, so the question will reach you through them if not through the law. With no EU establishment, you report to the national CSIRT of the EU country where your authorised representative sits, or failing that your largest importer, distributor or user base, in that order (Article 14(7)). Switzerland is preparing its own equivalent.
We sold the product years ago. Does the CRA apply to it too?
For reporting, yes. The reporting duty covers every product on the EU market on 11 September 2026, including units sold before that date, and it does not end when your support period ends. The design and fixing duties are different: they apply to units you place on the market from 11 December 2027, and to older products only if you substantially modify them after that date. A security update is not a substantial modification; a new feature that adds risk is.
If we launch before December 2027, do we avoid the full CRA requirements?
Only for the units that reach the EU market before that date. “Placed on the market” counts each unit, not the model. Units of the same product supplied from 11 December 2027 onward must comply in full: secure design, software list, fixing duty, support period, CE marking. A launch in November 2027 protects the stock already shipped and nothing else. Stand-alone software is the exception: a version counts as placed when it is first offered, and later copies of that same version go with it.
Our Bluetooth or Wi-Fi stack comes from the chip vendor. Is that their problem?
We already have CE marking. Is this not covered?
Is the self-check not enough?
A library we use is on the “exploited in the wild” list. Must we report within 24 hours?
Not by itself. The Commission’s guidance of July 2026 reads the duty narrowly: a vulnerability counts as actively exploited for your reporting duty only when there is reasonable certainty that it is being exploited in your product. If the vulnerable code is not reachable, or nobody has attacked your product through it, there is nothing to file. You still have to fix it, and you may report it voluntarily. The clock starts when evidence about your own devices arrives, and that is usually a CSIRT or a customer calling you.
What happens if we do nothing?
Do you take over the reporting for us?

Thirty minutes with an engineer, not a sales call.

Bring one product. We tell you which of the ten capabilities you already have, which you do not, and whether the readiness check is worth your money.

TALK TO AN ENGINEER

DOWNLOAD SELF CHECK (PDF)

A summary of the regulation as we read it, not legal advice.