Cyber Resilience Act (CRA) - preparing products for the EU market

Cyber Resilience Act (CRA) — preparing products for the EU market

The Cyber Resilience Act sets baseline cyber security requirements for products with digital elements sold on the EU market. It applies across the EU and covers a broad range of hardware and software products. If a product falls within scope, it must meet the CRA requirements and carry the CE marking before it can be placed on the market. The main obligations sit in Article 13, Article 14, and Annex I.

Most of the substantive obligations start to apply on 11 December 2027. The earlier reporting duties for actively exploited vulnerabilities and severe incidents start on 11 September 2026. For many manufacturers, that work cannot wait until the end of the transition period because product design, release processes, and documentation are already taking shape now.

Insta is one of Finland's leading cyber security service providers. Our Data & Cyber Compliance team helps manufacturers work out which products are in scope, what needs to change in development and vulnerability handling, and what technical documentation is needed to support compliance with CRA requirements and CE marking.

What the CRA requires

• The Cyber Resilience Act sets requirements in three areas through Article 13 and Annex I:

• The development process and the procedures that cover a product's lifecycle, from design to the end of the support period.

• The cyber security properties of the product itself.

• Vulnerability handling.

Design, development, and production
Article 13 and Annex I require products to be designed, developed, and produced with a level of cyber security that matches their risks. In practice, that means compliance cannot be left to the end. Product, engineering, testing, release, and supplier decisions all affect the outcome.

Product properties
Annex I also sets the core security expectations for the product itself. That includes safe default settings, protection of data, and the ability to address vulnerabilities through security updates. Products should not be placed on the market with known exploitable vulnerabilities. The exact measures depend on the product, its use case, and its risk profile.

Vulnerability handling
Annex I, Part II expects a working vulnerability-handling process. Manufacturers need to identify components and vulnerabilities, maintain an SBOM, and remediate issues without undue delay. Where possible, security fixes should be separated from feature updates.

Regular security testing, coordinated vulnerability disclosure, secure update delivery, and clear reporting channels are all part of that picture. Article 14 adds the related reporting obligations for actively exploited vulnerabilities and severe incidents. For many teams, this is where the real operational work starts.

How Insta helps

Insta brings together cyber security, secure development, and regulatory compliance expertise. The five services below are common starting points for CRA preparation. Some clients need a quick view of product classification and the main gaps; others need hands-on support through process changes, testing, documentation, and assessment.

CRA current-state assessment

This three-to-five-week engagement maps the product portfolio against the CRA, classifies products, and identifies the main compliance gaps. The result is more than a summary deck. It is a practical decision package with priorities, dependencies, effort estimates, and a backlog the engineering team can work from.

Secure development lifecycle (SDL) implementation

Insta SDL is based on IEC 62443-4-1 and can be aligned with an ISO 27001 management system. In practice, teams usually need help in specific places rather than everywhere at once: threat modelling, security requirements, supplier components, release checkpoints, remediation workflows, and evidence capture. If an organisation already works with frameworks such as NIST SSDF, IEC 62443-4-1, or OWASP SAMM, the additional work needed for CRA compliance is often smaller than it first appears.

Vulnerability handling and SBOM

Insta helps teams put a workable vulnerability-handling process in place. That can include coordinated vulnerability disclosure, intake and triage, ownership and escalation, SBOM generation in the build pipeline, and the reporting workflows needed from 11 September 2026 onward.

Technical documentation and CE marking

Insta supports the preparation of the technical file, the EU declaration of conformity, the support-period commitment, and the user instructions required by the CRA. A common problem in this phase is that the documentation and the shipped product do not fully match. We work with product, engineering, and legal teams to close that gap before assessment.

Penetration testing and conformity assessment support

Insta's team provides hardware, firmware, and software security testing. Where third-party assessment is required, we support the preparation of evidence, pre-assessment testing, remediation rounds, and the practical work needed before and during notified-body review.

Insta's CRA experts

Satu Streng, Senior Compliance Consultant — advises on data and cyber regulation across GDPR, NIS2, the AI Act, the Data Act, and the CRA. Her work includes regulatory interpretation and implementation planning for Nordic organisations that need to turn legal requirements into operating practice.

Jyrki Nivala, Senior Director, Cyber Consulting — leads Insta's cyber security consulting practice. He has worked for two decades across critical infrastructure, manufacturing, and the public sector.