CRA FAQ

Frequently Asked Questions on the Cyber Resilience Act

This document outlines a preliminary set of technical FAQs to assist stakeholders with the implementation of the Cyber Resilience Act (Regulation (EU) 2024/2847). It addresses recurring questions about the scope, definitions, interplay with other legislation, classification of products, manufacturer obligations, conformity assessments, and the transition period. The FAQs clarify compliance expectations, especially in relation to risk assessments, vulnerability management, product categories (default, important, critical), and alignment with existing EU laws like the GDPR, Data Act, and Machinery Regulation. It serves as a non-binding, living document prepared by Commission services to guide early compliance efforts.