Cyber Resilience Act (CRA) - preparing products for the EU market

Cyber Resilience Act (CRA) - preparing products for the EU market

The EU Cyber Resilience Act (CRA) establishes essential cybersecurity requirements for hardware and software products with digital elements. Products within its scope must comply with the requirements set out in particular in Articles 13 and 14 and Annex I. They must also bear the CE marking before being placed on the EU market.

The CRA’s main obligations will apply from 11 December 2027. However, the reporting obligations concerning actively exploited vulnerabilities and severe incidents will take effect earlier, on 11 September 2026. Manufacturers should begin preparing well in advance, as the requirements affect product development, vulnerability management, releases and technical documentation.

Insta is one of Finland’s leading cybersecurity service providers. Insta’s Data & Cyber Compliance team helps manufacturers identify products within the scope of the CRA, develop compliant processes, and prepare the technical documentation required for CRA compliance and CE marking.

What the CRA requires

• The Cyber Resilience Act sets requirements in three areas through Article 13 and Annex I:

• The development process and the procedures that cover a product's lifecycle, from design to the end of the support period.

• The cyber security properties of the product itself.

• Vulnerability handling.

Design, development, and production
Article 13 and Annex I require products to be designed, developed, and produced with a level of cyber security that matches their risks. In practice, that means compliance cannot be left to the end. Product, engineering, testing, release, and supplier decisions all affect the outcome.

Product properties
Annex I also sets the core security expectations for the product itself. That includes safe default settings, protection of data, and the ability to address vulnerabilities through security updates. Products should not be placed on the market with known exploitable vulnerabilities. The exact measures depend on the product, its use case, and its risk profile.

Vulnerability handling
Annex I, Part II expects a working vulnerability-handling process. Manufacturers need to identify components and vulnerabilities, maintain an SBOM, and remediate issues without undue delay. Where possible, security fixes should be separated from feature updates.

Regular security testing, coordinated vulnerability disclosure, secure update delivery, and clear reporting channels are all part of that picture. Article 14 adds the related reporting obligations for actively exploited vulnerabilities and severe incidents. For many teams, this is where the real operational work starts.

How Insta helps

Insta brings together cyber security, secure development, and regulatory compliance expertise. The five services below are common starting points for CRA preparation. Some clients need a quick view of product classification and the main gaps; others need hands-on support through process changes, testing, documentation, and assessment.

CRA current-state assessment
This three-to-five-week engagement maps the product portfolio against the CRA, classifies products, and identifies the main compliance gaps. The result is more than a summary deck. It is a practical decision package with priorities, dependencies, effort estimates, and a backlog the engineering team can work from.

Secure development lifecycle (SDL) implementation
Insta SDL is based on IEC 62443-4-1 and can be aligned with an ISO 27001 management system. In practice, teams usually need help in specific places rather than everywhere at once: threat modelling, security requirements, supplier components, release checkpoints, remediation workflows, and evidence capture. If an organisation already works with frameworks such as NIST SSDF, IEC 62443-4-1, or OWASP SAMM, the additional work needed for CRA compliance is often smaller than it first appears.

Vulnerability handling and SBOM
Insta helps teams put a workable vulnerability-handling process in place. That can include coordinated vulnerability disclosure, intake and triage, ownership and escalation, SBOM generation in the build pipeline, and the reporting workflows needed from 11 September 2026 onward.

Technical documentation and CE marking
Insta supports the preparation of the technical file, the EU declaration of conformity, the support-period commitment, and the user instructions required by the CRA. A common problem in this phase is that the documentation and the shipped product do not fully match. We work with product, engineering, and legal teams to close that gap before assessment.

Penetration testing and conformity assessment support
Insta's team provides hardware, firmware, and software security testing. Where third-party assessment is required, we support the preparation of evidence, pre-assessment testing, remediation rounds, and the practical work needed before and during notified-body review.

Insta's CRA experts

Satu Streng, Senior Compliance Consultant — advises on data and cyber regulation across GDPR, NIS2, the AI Act, the Data Act, and the CRA. Her work includes regulatory interpretation and implementation planning for Nordic organisations that need to turn legal requirements into operating practice.

Jyrki Nivala, Senior Director, Cyber Consulting — leads Insta's cyber security consulting practice. He has worked for two decades across critical infrastructure, manufacturing, and the public sector.