European Commission - Directorate General for Communications Networks, Content and Technology

03/03/2026 | News release | Distributed by Public on 03/04/2026 05:22

Commission publishes for feedback draft guidance to assist companies in applying the Cyber Resilience Act

The European Commission has published for feedback draft guidance to assist companies in meeting the obligations of the Cyber Resilience Act (CRA).

AdobeStock © ipopba

The draft guidance clarifies the obligations and the scope of the rules with a particular focus on facilitating compliance by microenterprises and small and medium-sized enterprises.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said:

With today's guidelines, the Commission supports the effective application of the Cyber Resilience Act. From baby monitors to smart watches, digital elements are part of our daily lives, and we will make sure all digital products on the EU market are safe from cyber threats.


The draft guidance focuses on remote data processing solutions and free and open-source software, the notion of 'support periods' as well as the interplay between the CRA and other EU legislation.

As part of the broader simplification exercise, the Commission is consulting stakeholders until 31 March to ensure alignment with implementation efforts, practical challenges, and market realities.

The CRA entered into force on 10 December 2024. The main obligations introduced by the Act will apply from 11 December 2027, with reporting obligations to apply as of 11 September 2026.

The Commission is actively working to strengthen the EU's cybersecurity resilience and capabilities. A new cybersecurity package was proposed on 20 January 2026.

European Commission - Directorate General for Communications Networks, Content and Technology published this content on March 03, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on March 04, 2026 at 11:22 UTC. If you believe the information included in the content is inaccurate or outdated and requires editing or removal, please contact us at [email protected]