Lawbster is desktop-first for professionals — but we won't let you down for a quick read.

Cyber Resilience Act (CRA)

Table of Contents

Timeline & key datesInsight

Chapter I — General provisions

Art. 1 — Subject matter Art. 2 — Scope Art. 3 — Definitions Art. 4 — Free movement Art. 5 — Procurement or use of products with digital elements Art. 6 — Requirements for products with digital elements Art. 7 — Important products with digital elements Art. 8 — Critical products with digital elements Art. 9 — Stakeholder consultation Art. 10 — Enhancing skills in a cyber resilient digital environment Art. 11 — General product safety Art. 12 — High-risk AI systems

Chapter II — Obligations of economic operators and provisions in relation to free and open-source software

Art. 13 — Obligations of manufacturers Art. 14 — Reporting obligations of manufacturers Art. 15 — Voluntary reporting Art. 16 — Establishment of a single reporting platform Art. 17 — Other provisions related to reporting Art. 18 — Authorised representatives Art. 19 — Obligations of importers Art. 20 — Obligations of distributors Art. 21 — Cases in which obligations of manufacturers apply to importers and distributors Art. 22 — Other cases in which obligations of manufacturers apply Art. 23 — Identification of economic operators Art. 24 — Obligations of open-source software stewards Art. 25 — Security attestation of free and open-source software Art. 26 — Guidance

Chapter III — Conformity of the product with digital elements

Art. 27 — Presumption of conformity Art. 28 — EU declaration of conformity Art. 29 — General principles of the CE marking Art. 30 — Rules and conditions for affixing the CE marking Art. 31 — Technical documentation Art. 32 — Conformity assessment procedures for products with digital elements Art. 33 — Support measures for microenterprises and small and medium-sized enterprises, including start-ups Art. 34 — Mutual recognition agreements

Chapter IV — Notification of conformity assessment bodies

Art. 35 — Notification Art. 36 — Notifying authorities Art. 37 — Requirements relating to notifying authorities Art. 38 — Information obligation on notifying authorities Art. 39 — Requirements relating to notified bodies Art. 40 — Presumption of conformity of notified bodies Art. 41 — Subsidiaries of and subcontracting by notified bodies Art. 42 — Application for notification Art. 43 — Notification procedure Art. 44 — Identification numbers and lists of notified bodies Art. 45 — Changes to notifications Art. 46 — Challenge of the competence of notified bodies Art. 47 — Operational obligations of notified bodies Art. 48 — Appeal against decisions of notified bodies Art. 49 — Information obligation on notified bodies Art. 50 — Exchange of experience Art. 51 — Coordination of notified bodies

Chapter V — Market surveillance and enforcement

Art. 52 — Market surveillance and control of products with digital elements in the Union market Art. 53 — Access to data and documentation Art. 54 — Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk Art. 55 — Union safeguard procedure Art. 56 — Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk Art. 57 — Compliant products with digital elements which present a significant cybersecurity risk Art. 58 — Formal non-compliance Art. 59 — Joint activities of market surveillance authorities Art. 60 — Sweeps

Chapter VI — Delegated powers and committee procedure

Art. 61 — Exercise of the delegation Art. 62 — Committee procedure

Chapter VII — Confidentiality and penalties

Art. 63 — Confidentiality Art. 64 — Penalties Art. 65 — Representative actions

Chapter VIII — Transitional and final provisions

Art. 66 — Amendment to Regulation (EU) 2019/1020 Art. 67 — Amendment to Directive (EU) 2020/1828 Art. 68 — Amendment to Regulation (EU) No 168/2013 Art. 69 — Transitional provisions Art. 70 — Evaluation and review Art. 71 — Entry into force and application

Recitals

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130

Annexes

Annex I Annex II Annex III Annex IV Annex V Annex VI Annex VII Annex VIII

Insights

EU Cyber Resilience Act Compliance Timeline & FAQ

Lawbster — EU Regulation Library Lawbster is a multilingual library of EU regulations for legal professionals, free to browse without an account — available in English, German, and French, with full regulation texts presented article by article.

Digital Markets Act (DMA)

Cybersecurity Act

Digital Services Act (DSA)

Data Governance Act (DGA)

Product Liability Directive (PLD)

Critical Entities Resilience Directive (CER)

Cyber Resilience Act (CRA)

DMA Implementing Regulation

Imprint · Privacy