Exporting devices to the EU? What the CRA asks of you

In short

• The EU Cyber Resilience Act (CRA) covers Indian companies whose connected products are sold in the EU, even with no office there.
• Since 11 September 2026, you must report flaws that attackers are actively exploiting within 24 hours. The full rules start on 11 December 2027.
• Start now: name a reporting owner, keep a software list (SBOM) for every release, set each product's support period and plan the technical file.

The Act reaches you without an EU office

If your connected products are sold in the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847) applies to you, even with no office there. The duty to report actively exploited flaws started on 11 September 2026. The rest applies from 11 December 2027: the security rules of Annex I, the technical file and CE marking, the EU's sign that a product meets its laws.

That leaves Indian exporters a little over a year to get their evidence in order. Firmware cycles are long, so the products you design this quarter are the ones that will meet the 2027 date.

Does it apply to you?

Probably, if anything you build reaches an EU buyer. The Act calls you the manufacturer if you develop or make the product and sell it under your name. If you build for an EU brand that sells under its own name, that brand is the manufacturer, and it will pass the duties to you through its contract.

Your importer cannot ignore it either. Under Article 19, an importer may put a product on the EU market only after making sure that you:

• carried out the conformity assessment, the check that the product meets the rules
• drew up the technical documentation
• supplied the CE marking, the declaration of conformity and the user information

Expect your importer's questionnaire to follow those words.

The dates

A product placed on the market before 11 December 2027 falls under the full rules only if it is substantially changed later. The reporting duty covers it from September 2026 either way.

Reporting since September 2026

When you learn that attackers are exploiting a flaw in your product, three reports follow:

• an early warning within 24 hours
• a notification within 72 hours
• a final report no later than 14 days after a fix or mitigation is available

A severe incident follows the same 24 and 72 hours, with a final report within a month.

Reports go through the Single Reporting Platform of ENISA, the EU's cyber security agency, live since 11 September 2026. A maker with no base in the EU reports to the CSIRT, the national computer security team, of one member state. It is the state where its authorised representative acts for most of its products. Failing that, it is its importer's, then its distributor's.

The authorised representative is the person in the EU you appoint to act for you. Decide who it is before the first incident, not during it.

The clock starts when you become aware. Someone in your company must own the inbox where researchers and customers write. That person must have the authority to send a report on a Sunday.

What evidence to keep

The technical file described in Annex VII is the core. Plan for it to hold at least:

• The cybersecurity risk assessment, updated during the support period (Article 13).
• A software bill of materials (SBOM) "in a commonly used and machine-readable format", covering at least the top-level dependencies (Annex I, Part II).
• How you chose the support period. It must be at least five years unless the product is expected to be in use for less. Its end date, at least the month and year, must be clear at the time of purchase.
• Your coordinated vulnerability disclosure policy, which tells outsiders how to report a flaw, and a single point of contact for vulnerability reports.
• Test reports and the EU declaration of conformity.

Keep the technical documentation and the declaration for at least ten years after the product is placed on the market, or for the support period if longer. Each security update must stay available for ten years after it is issued, or for the rest of the support period if longer.

Routers and security cameras need more

Routers, internet modems and switches are important products of class I in Annex III. So are smart home products with security functions, such as security cameras.

You can assess them yourself only by applying harmonised standards (EU standards that count as proof), common specifications or a European certification scheme in full. Otherwise a notified body, an approved outside assessor, takes part.

The harmonised standards the Commission requested under M/606 are still being written. Check whether one for your product has been cited in the Official Journal before you plan a self-assessment. If none has, book notified body time early.

The cost of doing nothing

The fines are the visible part. They reach EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential requirements or the duties in Articles 13 and 14. Market regulators in each country can also order a fix or a withdrawal.

For most Indian exporters the earlier cost is commercial. An importer that has reason to believe a product does not conform must not place it on the market. So the order stops at the importer's desk long before any regulator writes to you. Expect EU buyers to put the Act's own words into their supplier questionnaires: SBOM, support period and vulnerability handling.

A plan for the next twelve months

• This quarter: name the reporting owner, appoint or confirm an authorised representative, and publish a disclosure policy with a contact address.
• Next quarter: produce an SBOM for every release you ship to the EU and decide the support period per product line.
• By mid 2027: run the risk assessment, map your evidence to Annex I, and decide between self-assessment and a notified body for class I products.
• Before 11 December 2027: complete the technical file, the declaration of conformity and the user information of Annex II.

Keeping CRA evidence release by release

FDIE by Magdox fills much of the CRA paperwork from each analysed release, and people finish it. The app prepares the Annex VII technical file, the declaration of conformity and its simplified form, and the Annex II user information. An owner signs with a two-step code.

The Article 13 risk assessment starts from the newest release. It needs sign-off by an owner other than the person asking. On the Business plan, Article 14 cases run the 24 hour, 72 hour and 14 day clocks, and a person submits on ENISA's platform.

Of the 22 Annex I provisions in the app, the device checks decide 8 and help with 4. Product data answers 4, and 6 need your documents. That is evidence and gap finding, not certification. A notified body or a market regulator makes the final call.