EU CRA
EU Cyber Resilience Act (Regulation (EU) 2024/2847)
Mandatory cybersecurity requirements for all products with digital elements placed on the EU market, including AI software. Requires security by design, vulnerability handling, incident reporting to ENISA, software bills of materials, and CE marking for market access.
Jurisdiction
European Union
Enacted
Nov 20, 2024
Effective
Dec 11, 2027
Enforcement
National market surveillance authorities; ENISA for vulnerability reporting
Entered into force December 10, 2024. Vulnerability reporting obligations begin September 11, 2026. Full product compliance required by December 11, 2027.
European CommissionWhy It Matters
Applies cybersecurity requirements to AI systems as 'products with digital elements.' AI software placed on the EU market must meet security-by-design requirements, maintain vulnerability handling processes, and bear CE marking. Non-compliant products lose EU market access entirely.
Recent Developments
Entered into force December 10, 2024. Vulnerability reporting deadline approaching September 2026. Complements EU AI Act and NIS2 Directive.
At a Glance
Applies to
Who Must Comply
- Manufacturers of products with digital elements (including AI software)
- Importers and distributors of digital products in the EU
- All entities placing products with digital elements on the EU market
Safety Provisions
- Security by design: security must be addressed during design and development phases
- Vulnerability handling and management processes required
- Incident and vulnerability reporting to ENISA
- Software Bill of Materials (SBOM) generation required
- CE marking required for EU market access
- Security updates throughout product lifecycle
- Technical documentation for conformity assessment
Exemptions
Medical Devices
Medical devices and in vitro diagnostic devices regulated under separate EU frameworks
- • Regulated under MDR/IVDR
Motor Vehicles
Motor vehicles and components covered by type-approval regulations
- • Regulated under vehicle type-approval framework
National Security/Defense
Products for national security or defense purposes
- • Exclusively for national security or defense
Compliance & Enforcement
Key Dates
Sep 11, 2026
Vulnerability and incident reporting obligations to ENISA begin
Dec 11, 2027
Full compliance required: all products with digital elements must meet essential cybersecurity requirements and bear CE marking
Penalties
€15M or 2.5% revenue (whichever higher)
View on map
European Union
Focus Areas
Cite This
APA
European Union. (2024). EU Cyber Resilience Act (Regulation (EU) 2024/2847).
Related Regulations
EU AI Content Transparency Code
Voluntary code of practice under the EU AI Act that sets out how providers of generative AI systems can meet the Article 50(2) duty to mark AI-generated or manipulated content in a machine-readable, detectable way, and how deployers can meet the Article 50(4) duty to label deepfakes and AI-generated text published on matters of public interest. The Commission and the AI Board have assessed it as an adequate means of demonstrating compliance.
EU GPAI Code
Voluntary code enabling general-purpose AI model providers to demonstrate compliance with EU AI Act GPAI obligations. Three chapters cover transparency (model documentation), copyright compliance, and safety/security for systemic-risk models. Adherence creates legal presumption of conformity.
Italy D.Lgs. 160/2026
First of two legislative decrees implementing Italy's AI law (Law 132/2025) and adapting national law to the EU AI Act. Title I sets the first organic rules for police use of AI systems on a human-oversight basis, including exceptional, time-limited and judicially authorised real-time biometric identification and a ban on biometric databases built by untargeted mass scraping of the web. Title II introduces Penal Code Article 437-bis, punishing failure to adopt security measures in high-risk AI systems and their unlawful alteration, and gives claimants procedural tools for damages caused by AI systems: access to the system's technical documentation, a presumption of causal link, an alternative forum near the claimant's residence and direct action against the insurer.
DE Digital Violence Bill (GgdG)
German government bill creating a standalone Digital Violence Act (GgdG) that gives victims court-ordered disclosure of anonymous offenders' identities, data preservation, content removal and temporary account suspension against platforms, and adding Criminal Code offences for sexualised deepfakes, reputation-damaging deepfakes, identity misuse and covert tracking.
Norway AI-in-Schools Recommendations
Norwegian government national recommendations directing that generative AI should, as a general rule, not be used by pupils in primary school (grades 1-7), with gradual, teacher-supervised use permitted in lower secondary (grades 8-10) and appropriate-use education in upper secondary. Issued through the Directorate for Education and Training (Udir).
FR SREN
France's 2024 "digital space" law strengthening national digital regulation and enforcement levers via ARCOM across platform safety and integrity issues.
Last updated March 23, 2026. Verify against primary sources before relying on this information.