Secure Product Design
Build security in from the start and prove your product meets the essential requirements.
- Product Requirements (secure by design & default)
- Risk Assessment
- Supply Chain / Third-Party Due Diligence
New requirements for product security
Cyber Resilience Act
The EU Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for "products with digital elements" placed on the EU market. From secure-by-design to vulnerability handling and CE marking, manufacturers must demonstrate, and maintain, the security of their products across the entire lifecycle. Drawing on our experience in both regulatory consulting and product development, we can help you securing your products.
Talk to us- Dec 2024
- Entered into force
- Sep 2026
- Reporting obligations already apply
- Dec 2027
- All requirements apply
The core themes of the CRA
The CRA touches your products, processes and documentation. These are the building blocks you need to cover.
Vulnerability Management & Updates
Handle vulnerabilities and keep products patched across the whole support period.
- Vulnerability Handling
- Support Period / Security Updates
Conformity & CE Marking
Classify your product, run the right assessment and declare conformity.
- Product Classification
- Conformity Assessment
- CE Marking & EU Declaration of Conformity
Documentation & Information
Keep the required technical documentation and inform your users.
- Technical Documentation (Annex VII)
- User Information (Annex II)
Reporting & Market Surveillance
Report incidents in time and cooperate with the authorities.
- Reporting Obligations (24h / 72h)
- Single Point of Contact & Market Surveillance
Available now, free
CRA GAP-analysis tool
Our free self-assessment tool lets you determine your CRA readiness in a few minutes and get a GAP analysis with concrete recommended actions and CRA references. Start right away in your browser, or subscribe to the newsletter to stay informed about updates.
- Readiness score across the 12 core themes of the CRA
- GAP list with measures and CRA references
- Result as an individual PDF report
Or subscribe to the newsletter to stay informed about updates:
By signing up you consent to receiving our newsletter by email; you can unsubscribe at any time. For more information, see our privacy policy. Privacy Policy
Consulting and engineering from a single source
Most CRA requirements are implemented in the product and in the pipeline, not on paper. That is why we combine regulatory consulting with technical implementation: requirements become testable rules, and evidence comes straight out of build and operations.
CRA quick check
Free
The fast way in: within about an hour you know where you stand. Digitally via our CRA check (in German) or in a personal conversation.
- Whether and how you are in scope
- Traffic-light rating of the core themes
- Concrete immediate actions
Recommended entry point
CRA gap analysis
€1,500
The baseline for your product: we assess product, processes and documentation against the CRA requirements and prioritise the gaps.
- Risk-weighted gap list
- Roadmap to December 2027
- Pairs well with the reporting process module
CRA readiness programme
Quote by scope
From gap analysis to conformity: we implement the agreed modules with your team, at your pace and building on what you already have in place.
- Gap analysis as the starting point
- Implementation modules as needed
- Support through to CE marking
All prices excl. VAT. Modules can be booked individually or as part of the readiness programme.
Modules across the entire product life cycle
Each module delivers a result you need for conformity.
Before market entry
Understand risks, implement measures, demonstrate conformity.
- Risk assessment
- Intended purpose, threats and measures under Art. 13, documented for the technical documentation.
- Threat modeling
- Attack surfaces of your product, worked out together with the development team.
- Secure SDLC and policy as code
- Testable rules in CI/CD and cluster, SBOM straight from the build.
- Technical documentation
- Documentation under Annex VII, maintained across the life cycle.
- Conformity route and CE
- Product class, the fitting procedure, EU declaration of conformity and CE marking.
After market entry
Clear responsibilities for vulnerabilities, reports and updates.
- Reporting process under Art. 14
- Roles, deputies and platform access, with a rehearsed 24-hour early warning. This obligation already applies.
- Vulnerability management and SBOM upkeep
- A process with deadlines and an SBOM that stays current.
- Security updates and support period
- Update mechanism and a defined support period, security updates separate from feature updates.
Alongside
Knowledge and building blocks that stay with your team.
- In-house workshop
- One to two days on your own product. Result: a prioritised gap list and task allocation in the team.
- Policy-as-code building blocks and templates
- Reusable policies mapped to the CRA, templates for the reporting process and documentation.
Frequently asked questions
We're already ISO 27001 certified – do we even need this?
ISO 27001 is an excellent foundation, but it doesn't cover the CRA. The CRA is product legislation (for products with digital elements); ISO 27001 is a management system for your organisation. Much of your ISMS carries over — risk management, processes, governance — but product-specific duties such as conformity assessment, CE marking, vulnerability handling and incident reporting come on top. We show you what you can reuse and where the real gaps are.
Will anyone actually notice if we ignore it?
Yes. The CRA is enforced through EU market surveillance, like the CE obligations for other products. Authorities may order that products be removed from the market and impose fines of up to €15 million or 2.5% of global annual turnover. On top of that, customers, distributors and tenders increasingly require proof of conformity — and from 2027 affected products without CE marking may no longer be sold in the EU.
Our IT department handles cybersecurity — we're well set up.
That's valuable, but it addresses a different layer. Your IT department typically protects your internal infrastructure. The CRA is about the security of the products you place on the market — across their whole lifecycle, from secure-by-design through vulnerability handling to reporting obligations towards authorities. That needs product, development and regulatory expertise, not just IT operations.
When does the CRA apply?
The CRA entered into force at the end of 2024. The reporting obligations have applied since 11 September 2026, including for products already on the market. The full set of requirements follows from 11 December 2027. Because conformity takes lead time — processes, documentation, possibly a notified body — now is the time to start.
Are we even in scope?
In principle the CRA covers all "products with digital elements" placed on the EU market — hardware with software as well as standalone software. Some products already regulated sector-specifically (e.g. certain medical devices) are exempt. We clarify your scope in a short initial call.
Get CRA-ready
In a free intro call we clarify which entry point fits your product.
info@actsecure.eu