Cyber Resilience Act Compliance Testing

The CRA applies to any product with digital elements intended for the EU market that can connect directly or indirectly to a network or another device. Certain categories are excluded, including products already covered by sector-specific regulations such as automotive and medical devices. Element can help you determine whether your product is in scope, and which conformity route applies.

Class II important products face stricter conformity assessment requirements than Class I. Class I products cover higher-risk categories such as identity management software, browsers, and password managers. Class II covers products considered critical to infrastructure, such as operating systems, industrial control systems, and firewalls. The classification affects which conformity assessment route applies. Element can help you determine where your product sits based on its functions and intended use.

Most products fall into the default category and can follow a self-assessment route, provided you apply harmonized standards or common specifications. Class I important products can also self-declare in most cases. Class II important products require a Notified Body for conformity assessment, and Critical products listed in Annex IV must use a European Cybersecurity Certification Scheme. Element can confirm which route applies to your product based on its functions and intended use.

RED Articles 3.3(d), (e), and (f), now implemented through EN 18031, apply to radio equipment and have been mandatory since August 2025. The CRA extends similar requirements to all products with digital elements, including non-radio products. Testing completed for RED EN 18031 compliance can contribute toward CRA conformity assessment evidence, but additional requirements apply. Element can help you identify which CRA requirements can be met with existing RED test evidence and which additional requirements apply.

The Notified Body application window first opened in June 2026, and Element is in the process of its application for CRA Notified Body designation. Manufacturers can begin  CRA compliance testing with Element now, ahead of formal Notified Body designation, to build their technical documentation and close compliance gaps early. 

Reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, ahead of full CRA enforcement. From that date, manufacturers must submit a 24-hour early warning on first awareness of an actively exploited vulnerability, a 72-hour notification including corrective measures taken, and a 14-day final report once the vulnerability is resolved. Element's advisory services can help you build the internal processes needed to meet these windows.