CRA FAQ

🌟 New FAQs

FAQs added within the last 30 days

💫 Recently Updated FAQs

FAQs updated within the last 14 days

🏛️ CRA Basics

Official questions and answers from the European Commission

🛡️ The Cyber Resilience Act (CRA) itself

Essential information about the CRA regulation, its scope, timeline, and key requirements

🧑‍💻 Contributors

Understanding how the CRA impacts open source contributions, if at all

🧑‍🔧 Maintainers

Understanding the role of maintainers under the CRA and clarifying their obligations

🧰 Open source projects

Understanding the role of open source projects in the CRA

🌱 Open-Source Software Stewards

Understanding the steward role, obligations, and requirements under the CRA

🏭 Manufacturers

Understanding the manufacturer role and responsibilities under the CRA

🌐 Remote Data Processing Solutions

Understanding how remote data processing solutions (RDPS) substantially broaden the scope of the CRA

🔌 Standards

Understanding harmonised standards and their role in CRA compliance

📡 Important and Critical Product Categories

Understanding product categories and their impact on compliance in the CRA

🚒 Vulnerability Handling

Understanding vulnerability handling and incident response requirements in the CRA

🔍 Due diligence

Understanding the due diligence obligations of manufacturers

📋 Security attestations

Understanding security attestations and their role in CRA compliance

🇪🇺 EU Legislation

Understanding the broader EU legislative framework that supports the CRA

🇪🇺 Official FAQs

Message from the European Commission: "This preliminary set of technical Frequently Asked Questions (FAQs), published approximately two years before the entry into application of the Cyber Resilience Act (CRA), is designed to assist stakeholders in the implementation of the CRA. The FAQs are not meant to cover exhaustively the scope of the CRA, but rather aim to address recurring questions that the Commission services have collected since the entry into force of the CRA. This is intended to be a 'living document' that will be updated as and when necessary."

Current version: 1.2 (16 January 2026)