Expect questions on how you handle vulnerabilities across a product's life, how you report actively exploited ones, how long you support the product, and what component records you keep. The European Commission says reporting obligations apply from 11 September 2026 and main obligations from 11 December 2027. Check scope with counsel.
What the dates mean
The Cyber Resilience Act entered into force on 10 December 2024. Per the Commission's page, manufacturers must report actively exploited vulnerabilities from 11 September 2026, and the main obligations apply from 11 December 2027. The Commission also states the CRA requires manufacturers to handle vulnerabilities during the lifecycle of their products. So buyers in or selling into the EU are already asking, and the questions will grow as 2027 approaches.
Likely questions
| Buyer asks | What they want |
|---|---|
| Are your products in CRA scope? | Your own classification, with reasoning |
| How do you handle vulnerabilities over the lifecycle? | Intake, triage, fix, notify |
| How will you report actively exploited vulnerabilities? | Named owner, process, channel |
| How long do you provide security updates? | A stated support period |
| What component information do you keep? | Inventory or SBOM practice |
| How do you receive reports from researchers? | Disclosure policy and contact |
The regulation's recitals say vulnerability support should last no less than five years unless the product's expected lifetime is shorter, and they describe market surveillance authorities being able to request SBOMs for certain product categories. Read the text for your product class before you commit to numbers.
How to prepare
- Decide whether each product is in scope. Seek legal advice for borderline cases, such as pure SaaS.
- Write a vulnerability handling procedure with an owner and a decision log.
- Publish a disclosure contact. See security.txt, RFC 9116 and the CRA vulnerability contact.
- Keep a component record per release.
- State your support period for each product.
What not to claim
Do not say a product is "CRA compliant" or "certified" unless a legal conclusion and any required assessment support it. Say what you do and which obligations you are preparing for. The main obligations are not yet in force, so claims of full compliance today would be premature.
Keep answers factual and dated
Because the rules are new and guidance is still developing, put a review date on every CRA related answer and say that the position may change. Avoid describing future obligations as already met. A clear statement of what is in place today and what is planned is more useful to a buyer than a broad assurance.
Quick check
Do non-EU vendors need to care?
If you sell products with digital elements into the EU market, possibly yes. Ask counsel to check.
Is an SBOM mandatory under the CRA?
The Commission summary page does not mention SBOMs. Read the regulation text for your product class and confirm with counsel.
Safeguard provides SBOM and dependency scanning, reachability analysis and compliance evidence automation, with a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
