EU Cyber Resilience Act (CRA) Compliance Services

Understand the European Regulatory Context

Gain a clear view of the scope, objectives, and structure of the Cyber Resilience Act, including the products and economic operators affected by the regulation.

Read the CRA Essential Guide

CRA requirements apply throughout the product lifecycle, covering both manufacturer responsibilities and incident reporting obligations. Some reporting obligations will apply before full CRA compliance becomes mandatory.

CRA Manufacturer Obligations (Sept 2026)

Although full CRA compliance will not be mandatory until December 2027, the reporting of exploited vulnerabilities and severe incidents will become mandatory in September 2026.

CRA Reporting Obligations (Dec 2027)

Determine the Most Appropriate CRA Compliance Strategy

CRA compliance is not a one-size-fits-all process. Manufacturers must first identify how their products are classified, as this determines the available conformity assessment options and the level of independent evaluation that may be required.

A clear classification strategy can help reduce uncertainty, prioritize preparation activities, and avoid unnecessary compliance costs later in the process.

Paths towards CRA Compliance

Module A – Internal control

Under Module A, responsibility for demonstrating compliance remains with the manufacturer. The manufacturer must ensure that the product meets the applicable essential cybersecurity requirements, maintain the necessary technical documentation, and implement appropriate design, development, production, and vulnerability management processes. Once conformity has been demonstrated, the manufacturer issues the EU Declaration of Conformity, affixes the CE marking, and retains the required documentation for the applicable retention period.

Module B – EU-type examination

Module B involves an independent assessment performed by a notified body. The evaluation focuses on the product's technical design, supporting documentation, and vulnerability-handling processes to verify compliance with the applicable CRA requirements. When the assessment is successful, the notified body issues an EU-type examination certificate covering the approved product type.

Module C – Conformity to type based on internal production control

Following the successful completion of Module B, the manufacturer is responsible for ensuring that all manufactured products remain consistent with the approved type and continue to satisfy the relevant cybersecurity requirements. Appropriate production controls must be maintained, while the CE marking and Declaration of Conformity are issued and retained in accordance with regulatory requirements.

Module H – Conformity based on full quality assurance

Module H relies on a quality management system that covers the entire product lifecycle and has been approved by a notified body. The notified body assesses the effectiveness of the system and performs ongoing surveillance activities to verify continued compliance. Products assessed under this route are placed on the market with the CE marking and the corresponding Declaration of Conformity.

EU Cybersecurity Certification Schemes (CSA)

The Cybersecurity Act establishes European cybersecurity certification schemes that may be applicable to certain ICT products, services, and processes. Certification is conducted by accredited certification bodies or competent national authorities and provides assurance against defined cybersecurity requirements. Certificates issued under these schemes are recognised throughout the European Union.

Assess Your CRA Readiness

Determine whether your products fall within the scope of the CRA and evaluate your current cybersecurity maturity against key regulatory requirements. A readiness assessment can help identify gaps and define the most appropriate compliance strategy.

Organizations at an earlier stage may benefit from CRA training before undertaking a detailed gap analysis.

CRA Questionnaire CRA Training

CRA Standards and Evidence Reuse

Manufacturers should consider the availability of harmonised standards and how existing cybersecurity certifications may support their CRA strategy.

For Important and Critical products, previous certifications and quality systems can help streamline preparation and support evidence reuse across assessment routes.

Teron Labs’ existing accreditation as a Common Criteria laboratory and FIPS 140 testing laboratory means evidence from CC and FIPS 140 programmes can often be reused to support CRA preparation, particularly for the EUCC route.

CRA Interplay with EUCC CRA Standards Mapping

Align for CRA compliance now, with a future notified body

As part of the Applus+ Laboratories group, Teron Labs is aligned with Applus+ Laboratories’ progress through the Notified Body (NB) accreditation and notification process under the Cyber Resilience Act. In the meantime, manufacturers can already start preparing their products and technical documentation for CRA conformity assessment, particularly for routes involving third-party evaluation, such as Modules B+C and Module H.

Early preparation enables manufacturers to strengthen documentation, testing evidence, and cybersecurity processes, helping reduce risk and avoid unnecessary remediation later in the compliance journey.