Skip to main content

The EU Cyber Resilience Act (CRA): Impact On Product Development

CRA is a new piece of regulation that aims to ensure lifetime security and resilience against cyber threats for all products with digital elements. All manufacturers that sell their products in the EU market are responsible for their product's security throughout its lifetime, including 3rd party components, maintenance, documentation and official assessments.​

Pick a CRA Topic to Learn More*

Frequently Asked Questions

How Does the CRA Affect Software Developers?

The EU Cyber Resilience Act (CRA) requires software developers to build security into products from the design phase. This includes a cybersecurity risk assessment, secure-by-default configurations, and essential security capabilities such as using strong authentication. Products cannot be placed on the EU market with known exploitable vulnerabilities. Most products need security updates for at least five years.

Since September 11, 2026, actively exploited vulnerabilities and severe incidents must be reported: an early warning within 24 hours, followed by a fuller notification within 72 hours. All essential requirements apply to products placed on the EU market from December 11, 2027. Some products already covered by sector-specific EU regulations may fall outside the CRA’s scope. This is decided product by product, not by industry.

Do I Need a Software Bill of Materials to Be CRA Compliant?

The CRA requires manufacturers to compile a Software Bill of Materials (SBOM) that lists all the components that the product contains. It has to be in a machine-readable format. Read more: CRA | Software Bill of Materials (SBOM) for Qt & CRA Compliance

Are Software Developers Also Responsible for Third-Party Software?

Developers are responsible for all third-party and open-source components, documented in a software bill of materials (SBOM), and must provide technical documentation for conformity assessment.

How Do I Integrate CRA Requirements into the Product Lifecycle?

The CRA expects product teams to apply Secure Software Development Lifecycle (SSDL) practices across the entire product journey, from initial design and development through release and ongoing maintenance. Rather than being a single standalone requirement, this principle is embedded throughout the regulation.

In practice, organizations must be able to demonstrate and document the cybersecurity measures implemented at each stage of the product lifecycle, together with the rationale behind them. Product teams must also define the expected support period for the product and justify any circumstances that would result in a lifetime different from the CRA's default assumption of five years.

Are There Requirements Related to Documentation in the CRA?

Yes. The CRA requires manufacturers to maintain technical documentation that demonstrates compliance with the regulation's cybersecurity requirements.

This documentation should include items such as a cybersecurity risk assessment, descriptions of implemented security measures, references to applicable standards, vulnerability assessment results, and user-facing instructions. The documentation serves as evidence that cybersecurity has been addressed throughout the product lifecycle and that the product meets the CRA's requirements. Read more: CRA | User Instructions and Documentation

Are Qt Group Products CRA Compliant?

Qt Group has signed the EU Declaration of Conformity for the latest Qt Framework release, Qt 6.12 LTS commercial, making it the first Qt release to be compliant with CRA. Qt Group intends to sign EU Declarations of Conformity for its other products by December 2027. Read more: Qt 6.12 and CRA Compliance

CRA_update

NEW

Qt Framework Is Now CRA Compliant

Qt Group has signed its EU Declaration of Conformity for the commercial Qt Framework 6.12, making it the first Qt release for CRA compliance. While the conformity assessment process has been completed, the regulatory framework for applying CE marking under the Cyber Resilience Act is still evolving. Qt Group anticipates applying CE marking as soon as practicable.

In the meantime, the signed Declaration of Conformity demonstrates that Qt Framework 6.12 has been assessed against the applicable CRA requirements and that compliance has been formally declared by the manufacturer.

Read More On the Blog
Qt Foundation Images Cybersecurity tinified

WEBINAR

What the CRA Requirements Mean for You

Cybersecurity is no longer optional - it’s becoming a legal requirement. The CRA is reshaping how products with digital elements that are sold in the EU market are designed, developed, and maintained. With compliance deadlines fast approaching, now is the time to understand what’s required and how to get prepared.

Watch the recording of Qt Group’s webinar from May 28, for tangible examples of what the CRA means for your business - and what you can do today to stay ahead.


Watch the Webinar

Recent CRA Blog Posts

Qt 6.12 and CRA Compliance: Qt Group’s First Declared Release

Read More

How to Reach CRA Compliance

TL;DR Start with assessment and prioritization: Evaluate where your pr...

Read More

Why Cyber Resilience Requires a Cultural Shift

TL;DR Cyber resilience goes beyond compliance: The EU Cyber Resilience...

Read More

Qt Early Warning List Now Available for Commercial Customers

Qt customers with a commercial license now have the opportunity to sub...

Read More

CRA Timeline

December 10, 2024

CRA entered into
force

First announced in September 2021, the CRA was proposed by the European Commission on 15 September 2022 to complement the existing EU cybersecurity framework, including the NIS and NIS 2 directives, and EU cybersecurity act. Followed by negotiations and a provisional agreement between the co-legislators in 2023, the Council of the EU adopted the Cyber Resilience Act in December 2024.

September 11, 2026

Reporting requirements apply

The obligations concerning vulnerability reporting will be applied as from September 11th, 2026 - that's 21 months after the entry into force.

NOTE! This applies to all covered products on the EU market at that date, not just those placed on the market for the first time.

December 11, 2027

Full CRA requirements apply

All essential CRA requirements will be applied with a transition period of 36 months. That is, as from December 11th, 2027, all covered products placed on the EU market for the first time must be designed, developed, produced, and maintained in accordance with the essential cybersecurity requirements of the regulation. 

* The information contained on this page and this website does not constitute legal advice. It is provided for informational purposes and discussion of the subject matter only. Content is subject to change and The Qt Group does not guarantee the accuracy or currentness of the contents of this page nor is The Qt Group responsible for the content or operation of any external website that these pages link to—or that may link to—these pages. The information contained here is not, and should not be used as, a substitute for legal advice.