What is CRA?
The Cyber Resilience Act entered into force in December 2024. It sets cybersecurity requirements for products with digital elements, hardware and software, placed on the EU market, covering secure design, vulnerability handling and security updates. Reporting obligations for actively exploited vulnerabilities apply from September 11, 2026, and most other obligations from December 11, 2027.
Who needs it
- Startups selling software products or connected devices in the EU
- Hardware and IoT companies
What usually triggers it
- You place a product with digital elements on the EU market
- A distributor or customer asks about CRA readiness
How the process works
- Check which of your products are in scope and in which category
- Set up vulnerability handling and reporting
- Build security into design and updates
- Prepare technical documentation and conformity assessment
How Holam helps
We work out whether CRA is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
Does the CRA cover pure SaaS?
Remote data processing that is not part of a product is generally outside its scope, but many SaaS companies also ship apps or agents that are in scope. Check product by product.