Ireland Update: The Cyber Resilience Act
- Published
- in Industry Updates
Introduction
The Cyber Resilience Act (Regulation (EU) 2024/2847)1 (“CRA”) establishes horizontal cybersecurity requirements for products with digital elements (“PDEs”) placed on the European Union (“EU”) market. Reporting obligations took effect on 11 September 2026, with full application of the CRA from 11 December 2027.
Scope – A Three-Step Analysis
A three-step process can be used to determine whether an organisation falls within the CRA’s scope:
Step 1: Is the product a PDE?
A PDE is “a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”. “Remote data processing solutions” (“RDPS”) involve (i) data processing at a distance, (ii) without which a PDE cannot perform one of its functions and (iii) software designed and developed by the manufacturer, or under its responsibility.
PDEs fall within the scope of the CRA where their intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. While “data connection” is not a defined term, guidance from the European Commission2 (“Guidance”) clarifies that it involves transmitting information in binary form. Where electrical or electronic signals are used solely to trigger or power a function, without conveying digitally encoded information, no data connection exists. Accordingly, the scope of the CRA is anchored not in the mere presence of electronics, but in the capacity of a product with digital elements to exchange digital information.
The National Cyber Security Centre interprets PDEs broadly as any product that can connect to a device or network – if a product has a chip, runs code and uses a data connection (Wi-Fi, Bluetooth or physical network) to function, it is likely in scope.3 Examples of PDEs include laptops, smartphones, smart fridges, industrial IoT devices, operating systems, standalone mobile apps and cloud services that a device cannot perform a function without.
Step 2: Is the product being made available on the EU market?
The CRA applies to PDEs placed on or made available on the EU market, including products manufactured outside the EU that reach it through importers or distributors.
Step 3: Does an exclusion apply?
Certain products are excluded, including those already covered by specific sectoral EU legislation4, products developed exclusively for national security or defence and spare parts manufactured to the same specifications as the originals. Products placed on the market before 11 December 2027 are also generally exempt from full CRA requirements unless substantially modified. However, reporting obligations apply to all in-scope products placed on the market before that date.
Risk Classifications
In-scope products are classified into the following risk categories:
Default Category
Most PDEs fall into this category and are subject to manufacturer self-assessment (internal control, Module A). This category covers any in-scope PDE whose core functionality does not match an important or critical product category listed in Annexes III or IV.
Important Products (Annex III)
Important products are split into two classes: (i) Class I includes physical and virtual network interfaces, identity management systems, browsers, password managers, VPNs, network management systems, SIEM tools, routers, modems, operating systems and other specified products. Self-assessment is permitted where harmonised standards are fully applied; otherwise, third-party conformity assessment is required and (ii) Class II includes hypervisors, container runtimes, firewalls, intrusion detection/prevention systems and tamper-resistant microprocessors. Third-party conformity assessment is always required.
Critical Products (Annex IV)
Critical products include hardware security boxes, smart meter gateways and smartcards or similar secure elements and may require European cybersecurity certification.
Commission Implementing Regulation (EU) 2025/23925 provides formal technical definitions for important and critical products and should be reviewed when determining scope. Classification depends on a product’s core functionality (i.e. its main features and technical capabilities, without which it would not meet its intended purpose), rather than on whether it integrates a component with important or critical functionality.
Key Roles Under the CRA
The CRA assigns obligations to manufacturers, importers, distributors, authorised representatives and open-source software stewards. Manufacturers carry the primary compliance burden and include any natural or legal person who develops, manufactures, or has products designed, developed or manufactured and markets them under their own name or trademark. An organisation may also become a manufacturer by making a “substantial modification” to a PDE after its placing on the market – that is, a change which (i) affects compliance with the essential cybersecurity requirements in Annex I, Part I or (ii) alters the intended purpose for which it was assessed.
Key Obligations by Role
Manufacturers
Key manufacturer obligations include designing, developing and producing products in accordance with the essential cybersecurity requirements in Annex I; conducting a cybersecurity risk assessment; preparing technical documentation; affixing the CE marking; handling vulnerabilities throughout the support period (minimum five years); and notifying actively exploited vulnerabilities and severe incidents. Products conforming with harmonised technical standards (to be published) will benefit from a presumption of conformity.
Importers
Importers must verify that the manufacturer has completed the appropriate conformity assessment and that the product bears the CE marking and required documentation. They must inform the manufacturer and market surveillance authorities of any non-compliance.
Distributors
Distributors must verify that the product bears the CE marking and that the manufacturer and importer have fulfilled their obligations. They must not make non-compliant products available and must inform the manufacturer of any vulnerabilities they become aware of.
Open-Source Software Stewards
Open-source software stewards must document a cybersecurity policy, cooperate with market surveillance authorities and comply with reporting obligations.
Incident Reporting Obligations
Since 11 September 2026, manufacturers must report: (a) any actively exploited vulnerability in the product and (b) any severe incident affecting product security. Under the Guidance, a manufacturer becomes “aware” once an initial assessment gives it reasonable certainty that active exploitation or a severe incident has occurred. Reporting timelines are:
- Early Warning: within 24 hours of becoming aware of the vulnerability or incident;
- Detailed Notification: within 72 hours;
- Final Report: within 14 days of a corrective/mitigating measure for actively exploited vulnerabilities, or 1 month for severe incidents; and
- Impacted Users: notify users of any risk mitigation and corrective measures.
Reports must be submitted via ENISA’s Single Reporting Platform to the designated Computer Security Incident Response Team (“CSIRT”) in the manufacturer’s main EU member state and simultaneously to ENISA.
Products placed on the market before 11 December 2027 are also subject to these obligations, though only for exploits discovered after 11 September 2026. Unlike vulnerability handling obligations, which end when the support period expires, reporting obligations continue to apply after that period expires.
Administrative Fines
Administrative fines range from €5 million to €15 million (or 1% to 2.5% of worldwide annual turnover, whichever is higher), depending on the nature and severity of the breach. Micro and small enterprises are exempt from fines for failure to meet early warning deadlines and open-source software stewards are fully exempt from administrative fines.
Next Steps
Key steps for organisations are:
- Assess whether their products are PDEs within the CRA’s scope.
- Identify their role (manufacturer, importer, distributor or open-source software steward).
- Classify products by risk category (default, important or critical) and determine the applicable conformity assessment procedure.
- Test incident reporting readiness as reporting obligations are now in effect.
- Plan for full CRA compliance by December 2027.
Further Information
For further information, please contact your usual Maples Group contact or any of the persons listed on this page.
1 https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng
3 https://www.ncsc.gov.ie/pdfs/National_CRA_Guidelines_v1.pdf
4 For example, medical devices, in vitro diagnostics, motor vehicles, aviation and marine equipment.
