iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, applies according to what a product is and how it is placed on the EU market—not simply because a business is Irish or works in technology. Its reporting duty has applied since 11 September 2026; most product requirements apply from 11 December 2027. Irish businesses should map their products, market roles and reporting process now.
Does the CRA apply to your product?
The CRA is an EU regulation for products with digital elements made available on the EU market. That can include hardware, software and qualifying remote data processing solutions. A product may be in scope if its intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical connection to a device or network. The relevant product may also be a separately placed component, not just a finished device.
Making a product available in commercial activity can include supplying it free of charge. The company’s location alone does not decide scope: an Irish business needs to examine the product, its EU market activity and its role in bringing that product to market. Some products are excluded, including certain products covered by other EU legislation. Check the exclusions in the Regulation rather than assuming that a product category is automatically in or out.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Do not assume every app, SaaS product or open-source project has the same answer
For software and services, assess the product boundary, intended and reasonably foreseeable use, any relevant remote data processing, how the product is made available, and whether an exclusion applies. The label “SaaS,” “app,” “embedded software” or “open source” does not by itself settle the question. The European Commission’s non-binding guidance published on 27 July 2026 addresses scope, including remote data processing and open-source software, and contains 67 practical examples, according to the Commission announcement.
#1 Best Overall
Which CRA role does your company have?
The principal duties fall on the manufacturer: the person or company that places a product on the market under its own name or trademark. A business that designs or builds a product for sale under its own brand may therefore need to assess manufacturer duties even if another company did the manufacturing work.
Importers and distributors have separate obligations, including verification, providing information, cooperating with authorities and taking corrective action where required. A legal person that provides sustained, systematic support for qualifying free and open-source software intended for commercial activity may meet the Regulation’s definition of an open-source software steward, with its own responsibilities. This does not mean all open-source code is exempt, or that every contributor is a steward. The European Commission’s summary and Regulation (EU) 2024/2847 set out the respective roles and duties.
When do CRA requirements take effect?
| Date | What applies |
|---|---|
| 10 December 2024 | The CRA entered into force, according to the European Commission. |
| 11 June 2026 | Provisions on notification of conformity-assessment bodies apply, according to the European Commission. |
| 11 September 2026 | Article 14 reporting obligations apply, according to the European Commission. The ENISA Single Reporting Platform is the reporting route. |
| 11 December 2027 | The main product obligations apply, according to the European Commission. |
The gap between the reporting date and the general application date matters: the European Commission says Article 14 reporting applies to products made available on the EU market before 11 December 2027 as well as later products. The later start for most design, conformity and product-information requirements does not postpone that reporting duty.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What must Irish manufacturers report, and by when?
Article 14 covers actively exploited vulnerabilities and severe incidents that affect the security of a product with digital elements. The Irish National Cyber Security Centre (NCSC) describes the reporting timetable as follows:
Rank #3
- Within 24 hours of becoming aware: submit an early warning.
- Within 72 hours of becoming aware: submit a detailed notification. The NCSC describes this as due within 48 hours after the early warning.
- For an actively exploited vulnerability: submit the final report no later than 14 days after a corrective patch or workaround becomes available.
- For a severe incident: submit the final report within one month of the detailed notification.
These are the staged periods described by the Irish NCSC on its CRA page, last updated 11 September 2026. The deadlines start from different events, so record when the manufacturer became aware, when the early warning and detailed notification were filed, and when a patch or workaround became available, as applicable.
Where an Irish manufacturer files
Submit the report through ENISA’s CRA Single Reporting Platform (SRP). The European Commission says the platform routes it to the Computer Security Incident Response Team (CSIRT) for the Member State where the manufacturer has its main establishment and makes it available to ENISA. The initial CSIRT shares it with other relevant Member State CSIRTs. For an Irish manufacturer, the main-establishment location affects routing; it does not change the SRP submission route.
The NCSC says only SRP filings satisfy the statutory reporting requirement. Its email address is an emergency fallback only if ENISA declares the platform offline; if that happens, file the formal notification in the SRP once it is available. The NCSC also states that manufacturers remain responsible for vulnerability handling throughout a product’s full operational lifecycle.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should a manufacturer prepare before selling a connected product?
The CRA takes a product-lifecycle approach. The European Commission’s summary describes duties that begin with cybersecurity risk assessment and extend through planning, design, development, production, delivery and maintenance. A practical preparation plan is to:
Best Value
- Inventory EU-facing products and components. Record what is made available in the EU, including relevant software and separately placed components.
- Assign the legal role for each product. Identify the manufacturer, importer and distributor as applicable, including who places the product under its name or trademark.
- Document the scope decision. Assess intended purpose, reasonably foreseeable use, connections, relevant remote data processing and any potentially applicable exclusion.
- Map dependencies and third-party components. Establish how components are selected and how the manufacturer exercises due diligence on integrated components.
- Build vulnerability handling into operations. Set up intake, triage, remediation, patching and escalation processes, and rehearse the SRP reporting flow against the applicable deadlines.
- Set and communicate a support period. Include the support-period end date in product information; the Commission summary says it must be clearly communicated.
- Keep compliance evidence. Retain the risk assessment and selected technical measures in technical documentation available to market-surveillance authorities.
- Determine the product category and conformity route. Assess whether the product is ordinary, important class I, important class II or critical, then select the applicable assessment procedure before placing it on the market.
Before market placement, manufacturers must complete the relevant conformity procedure. Following successful assessment, they draw up the EU declaration of conformity and affix CE marking. Product information must also include identifying details, manufacturer contact details and instructions, as well as the support-period end date, according to the Commission summary.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which conformity assessment route applies?
There is no single route for every product. The available path depends on product classification and whether applicable standards, common specifications or a European cybersecurity certification scheme are available and relevant. The European Commission’s summary describes the routes this way:
| Product category | Assessment route described by the Commission |
|---|---|
| Products not classified as important or critical | Manufacturers generally may use internal control (self-assessment), third-party assessment through a notified body, or an applicable European cybersecurity certification scheme. |
| Important class I | Self-assessment is available only under the specified standards, common-specification or certification conditions. Otherwise, third-party assessment is required. |
| Important class II | Third-party assessment or an applicable European cybersecurity certification scheme is required. |
| Critical | Third-party assessment or an applicable European cybersecurity certification scheme is required. |
Do not select a route based on a general assumption that self-assessment is always available. Classification, the applicability of the relevant standards or common specifications, and the availability and applicability of a certification scheme all matter. The Commission implementation tracker listed first standardisation deliverables for Q3 2026 and further deliverables for 30 October 2027. Those are dated milestones, not proof that every final harmonised standard is published or applicable; verify current status before relying on a standard for a presumption of conformity.
What Irish companies should do first
For a business with products already on the EU market, the immediate operational priority is to identify who acts as manufacturer and ensure the team can recognise and report a qualifying vulnerability or severe incident through the SRP. For products being developed or prepared for market, start scope and role mapping, then build the risk, component, documentation and assessment work into the product plan. The Commission’s 27 July 2026 guidance is a useful interpretive aid, particularly for scope and small businesses, but it is expressly non-binding; the Regulation is the binding legal text.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
