ServicesCRA Readiness
From 11 December 2027, every connected product sold in the EU must meet the CRA, and the reporting duty already applies. We are hardware and firmware engineers. We find out what applies to your product, build the security into the board and the code, and help you put together the evidence you sign.
The CRA applies in steps. The first duty, reporting, already covers products on the market today.
10 Dec 2024
In force
The regulation entered into force.
11 Jun 2026
Notified bodies
Rules for third-party assessment apply.
11 Sept 2026
Reporting
Exploited vulnerabilities and severe incidents must be reported, also for products already sold.
Today · 5 Nov 2026
11 Dec 2027
Full application
All requirements apply to products placed on the EU market.
Norway: the CRA is not yet part of the EEA agreement. The government plans the same date, 11 December 2027, with Nkom supervising.
Four steps, per product. You can stop after any of them.
Fixed price per product
We find out what applies and where you stand.
Hourly, capped per work package
We close the gaps in the product itself.
Part of the build
You get a file you can sign and defend.
Optional monthly retainer
Your duties last as long as the support period.
You stay the manufacturer: you own the risk decisions and sign the declaration of conformity. We design, draft and review.
Annex I sets 13 security requirements for the product itself. Most are decided on the circuit board and in the firmware, the work we do every day. Grouped into four themes:
Annex I, Part I(2), requirements (a) to (m). The right measures follow from your risk assessment.
A short version, by product phase, with the place in the regulation. The full list has about 40 duties; the readiness check maps your product against all of them.
Each country sets its fines, up to these limits per infringement: the amount or the share of worldwide annual turnover, whichever is higher (Art. 64).
€15m or 2.5 %
Breaking the security requirements in Annex I, or the manufacturer and reporting duties in Articles 13 and 14.
€10m or 2 %
Other obligations, such as the declaration of conformity, the CE marking and the technical documentation.
€5m or 1 %
Incorrect, incomplete or misleading information given to authorities or notified bodies.
Fines can come on top of other measures, such as withdrawing the product from the market. Company size is taken into account, and micro and small manufacturers are not fined for missing the 24-hour early-warning deadline (Art. 64(10)).
Four questions, about a minute. A first indication, not a legal assessment.
Question 1 of 4
Does the product run software or firmware?
Funding
The EU SECURE project’s second open call, open until 11 December 2026, co-funds CRA work for small and medium-sized companies: up to €30,000 per company at 50 %. Norway is among the eligible countries, and consultants can be included as subcontractors. Only costs after the grant agreement count, so it suits work planned for 2027. Help with technical documentation is not covered in this call.
Read the call ↗Not yet as Norwegian law: it is not yet part of the EEA agreement (Nkom, September 2026). The government plans the same date as the EU, 11 December 2027, and Nkom will supervise. Products you sell in the EU must comply anyway, and since 11 September 2026 Norwegian makers report exploited vulnerabilities to an EU country where the product is sold.
Units placed on the market before 11 December 2027 only need the reporting duty, unless you substantially change them. But each unit counts on its own: a unit of an older model sold after that date must comply. An older design needs no redesign if the risk assessment and technical file show its security is adequate.
You do, as the manufacturer. You own the classification, the risk assessment, the technical file and the CE mark. That also applies if you sell a product made by someone else under your own brand. We provide method, templates, drafts and reviews, and design the hardware measures. This is not legal advice.
No CRA standard was cited in the Official Journal at the start of October 2026. Until one is, you show conformity against Annex I directly, through your risk assessment, using recognised references such as ETSI EN 303 645, IEC 62443 and the draft EN 40000 series.
Yes. We often design the hardware security and review the firmware your team writes, or we write the security-critical parts ourselves: bootloader, signed updates and key handling.
The readiness check is a fixed price per product. Build work is hourly with a cap per work package, and ongoing support is a monthly retainer. Rates are ex. MVA (25%); EU business clients are invoiced with reverse charge.
General information, checked in October 2026. Not legal advice: as the manufacturer, you own the classification, the risk decisions and the declaration of conformity.
Tell us about your product. We reply with what applies, what is missing and a fixed price for the check.