CRA in Estonia: short answer
The Cyber Resilience Act (Regulation (EU) 2024/2847) is an EU regulation, so it applies directly in Estonia without a separate national transposition. It covers products with digital elements that are made available on the EU market in the course of a commercial activity.
Reporting obligations apply from 11 September 2026. The main product obligations, including technical documentation, vulnerability handling and conformity assessment, apply from 11 December 2027. A product can be hardware, software or a separately marketed component.
The CRA is not a one-off certificate. Manufacturers need a risk assessment, secure development and default configuration, a vulnerability process, an SBOM, a support period, technical documentation and a declaration of conformity.
Does the CRA apply to your product?
Three questions decide most cases:
- Is it a product with digital elements? Hardware, software or a component whose intended or reasonably foreseeable use includes a direct or indirect logical or physical connection to a device or network.
- Is it made available on the EU market? This includes selling, licensing, free distribution as part of a commercial model and remote data processing that is necessary for a product function.
- Is it a commercial activity? A price is not required. Monetisation through support, services or data can be enough. Open-source software developed outside a commercial activity is generally outside scope, but commercial integration can change that.
Examples include routers, cameras, smart devices, operating systems, applications, firmware, industrial controllers and separately sold software components. A medical device, motor vehicle or another product covered by a more specific EU rule may sit outside the CRA where that rule provides the same or a higher level of protection.
Short CRA scope check
Answer four questions. The check runs only in your browser; nothing is uploaded.
Default, important and critical products
| Category | Examples | Conformity route |
|---|---|---|
| Default | Most products with digital elements not listed as important or critical. | Internal control and self-assessment, with technical documentation. |
| Important — class I | Identity management, browsers, password managers, network interfaces, certain operating systems. | Self-assessment may be possible where harmonised standards, common specifications or a certification scheme are applied; otherwise a notified body may be needed. |
| Important — class II | Hypervisors, firewalls, intrusion detection systems, certain industrial and security products. | Generally third-party assessment. |
| Critical | Security chips, certain hardware security modules and other listed critical products. | Third-party assessment and, where required, a European cybersecurity certificate. |
The lists are in CRA Annexes III and IV and are refined by implementing acts. Check the current legal text before deciding the route; do not infer the category from the product name alone.
Manufacturer duties
- Risk assessment: intended use, environment, threats, impact and chosen measures.
- Secure by design and by default: minimal attack surface, secure configuration, least privilege and protection of confidentiality, integrity and availability.
- Vulnerability handling: a contact point, intake, triage, remediation, security updates and coordinated disclosure.
- SBOM: components and versions, suppliers, dependencies and a process for matching them to vulnerabilities.
- Support period: at least five years unless the expected product lifetime is shorter; state it clearly before purchase.
- Technical documentation and conformity: risk analysis, architecture, test evidence, EU declaration of conformity and CE marking where required.
- User information: secure installation, configuration, updates and the end of support.
Importers and distributors have their own checks. A component supplier does not lose responsibility when its component is integrated into another product.
CRA incident and vulnerability reporting
| When | Report | What to include |
|---|---|---|
| Within 24 hours | Early warning | The vulnerability or incident, affected products, member states where available, and initial risk. |
| Within 72 hours | Notification | Initial assessment, affected versions, exploitation status and measures taken. |
| 14 days after a corrective measure | Final report for an exploited vulnerability | Root cause, remediation, affected users and lessons learned. |
| 1 month after the 72-hour notification | Final report for a severe incident | Incident impact, response, recovery and preventive measures. |
Manufacturers report actively exploited vulnerabilities and severe incidents through the EU single reporting platform. Keep the evidence: timeline, affected versions, exploitation indicators, customer communication and the update that fixed the issue.
SBOM and the evidence pack
An SBOM is not a PDF attachment produced once. It is a maintained inventory that lets you answer: which component and version is in which product, which supplier owns it, and which vulnerability affects it.
- Inventory: direct and transitive components, versions and suppliers.
- Vulnerability matching: CVE/advisory feed, triage owner and remediation SLA.
- Release linkage: SBOM version tied to a product release and build.
- Update process: how a component change updates the SBOM and triggers testing.
- Customer evidence: a machine-readable extract where appropriate, plus a clear support and disclosure contact.
Our English SBOM guide and the Estonian CSV template show a practical structure. A penetration test can test a product; it does not replace the SBOM or the vulnerability process.
30-day CRA readiness plan
- Days 1–3: classify the product, commercial model and EU market status.
- Days 4–7: list components and owners; open the SBOM and vulnerability register.
- Days 8–14: test secure defaults, update path, access control and logging.
- Days 15–21: document risk analysis, support period and user information.
- Days 22–30: run a reporting tabletop, fix the evidence gaps and assign owners.
Request a scoping call or compare the CRA with NIS2 in Estonia.
Frequently asked questions
When does the CRA apply?
Reporting obligations apply from 11 September 2026. The main product obligations, including conformity assessment and CE marking, apply from 11 December 2027.
Does the CRA apply to software?
Yes. It applies to hardware and software products with digital elements, including separately marketed components and remote data processing necessary for a product function.
Is an SBOM mandatory?
Manufacturers must identify and document components and vulnerabilities. An SBOM is the practical way to do this and is expected in technical documentation, even though the CRA does not prescribe one file format.
How long is the support period?
At least five years, unless the product's expected lifetime is shorter. The support period must be clear to users before purchase.
What are the CRA reporting deadlines?
An early warning within 24 hours and a notification within 72 hours. The final report is due 14 days after a corrective measure, or one month after the 72-hour notification for a severe incident.
Does a penetration test prove CRA compliance?
No. A test can provide technical evidence, but it does not replace risk assessment, technical documentation, an SBOM, vulnerability handling or conformity assessment.