The Cyber Resilience Act: what it means for your business
By Stephen Cook
From 11th September 2026, a new EU regulation starts changing how connected products and software are built, sold and supported – and UK businesses trading into Europe are firmly in scope [1] [2]. Here is what the Cyber Resilience Act actually requires, why it matters beyond the compliance paperwork, and how Espria helps clients meet it.
What is the Cyber Resilience Act?
The Cyber Resilience Act (CRA) is an EU regulation – Regulation (EU) 2024/2847 – that sets mandatory cybersecurity requirements for “products with digital elements.” In practice, this covers hardware and software that can connect to a device or network: IoT devices, routers and connected industrial equipment, standalone software and firmware, and remote data processing services such as cloud applications, web services and mobile apps. [1]
It applies to manufacturers, importers and distributors of these products, and it applies regardless of where the company is based. If your product or service is placed on the EU market, or put into service in the EU, the CRA applies – UK-based businesses are not exempt simply because the UK has left the EU. [1] [2]
A small number of product categories are excluded because they are already regulated elsewhere, including medical devices, automotive components and marine equipment, along with non-commercial open-source software. [1]
Why it matters now
Two dates matter most:
- 11th September 2026 – vulnerability and incident reporting obligations begin. Manufacturers must report actively exploited vulnerabilities and severe incidents to their national Computer Security Incident Response Team (CSIRT) and to ENISA, on a strict three-stage timeline: an early warning within 24 hours, a detailed notification within 72 hours, and a final report. [1] [2]
- 11th December 2027 – full compliance is required, covering secure-by-design and secure-by-default engineering, Software Bills of Materials (SBOMs), technical documentation and CE marking for any new product placed on the EU market. [1] [3]
The reporting obligation reaches products already on the market today, so the infrastructure to detect and report vulnerabilities needs to be in place well before September 2026 – not built in response to the first incident. [1] [2]
The impact on Espria clients – especially those operating in Europe
Many Espria clients develop or resell software, connected devices or cloud-based services, or embed them in the products and platforms they sell. If any part of that portfolio reaches EU customers – directly, through a distributor, or as an OEM component in someone else’s product – the CRA applies to your business, even though it is UK-based. [2] [5]
This sits alongside, but is separate from, the UK’s own Cyber Security and Resilience Bill, which is progressing through Parliament and will extend similar duties to UK managed service providers and digital supply chain businesses domestically. The two regimes are not the same, and businesses trading in both markets should expect to meet both sets of obligations. [7]
For clients selling into Europe, the practical impact includes:
- Products cannot legally carry the CE mark, and therefore cannot be placed on the EU market, without evidence of conformity with the CRA’s security requirements. [1]
- Distributors and importers in the EU share legal responsibility for CRA compliance, so contracts and due diligence with EU partners need to reflect this. [1]
- Vulnerability disclosure and incident response processes need to be fast, documented and auditable – informal or ad hoc handling will not meet the 24- and 72-hour reporting windows. [2] [3]
The cost of getting it wrong
The CRA carries some of the toughest penalties in EU digital regulation. The most serious breaches carry fines of up to €15 million or 2.5% of global annual turnover, whichever is higher. Other breaches of market-access and documentation obligations can attract fines of up to €10 million or 2%, and providing false or misleading information to authorities can cost up to €5 million or 1% of global turnover. Beyond the fines, non-compliant products simply cannot be sold in the EU – a direct hit to revenue and market access, not just a regulatory risk. [6]
What compliance actually delivers
Treated only as a compliance exercise, the CRA is a cost. Treated properly, it delivers real business value:
- Fewer exploitable vulnerabilities, because secure-by-design principles are built into development rather than bolted on afterwards. [1]
- Full visibility of software supply chains through SBOMs – knowing exactly what is inside every product, which shortens the time to respond when a new vulnerability is disclosed elsewhere in the industry. [3]
- Faster, more structured incident response, because the reporting workflow already exists rather than being improvised under pressure. [2] [3]
- A genuine competitive advantage in EU procurement and enterprise tenders, where cybersecurity due diligence is increasingly a condition of doing business. [5]
- Less duplicated effort where clients already hold Cyber Essentials or ISO 27001 – much of that existing control environment maps directly onto CRA requirements.
What clients need to do
- Map the product and service portfolio to identify which items count as “products with digital elements” and confirm which are placed on the EU market, directly or indirectly. [1] [5]
- Stand up vulnerability handling and incident reporting processes now, ahead of the 11 September 2026 deadline, including a clear route to the relevant CSIRT and ENISA. [2] [3]
- Build and maintain SBOMs for software components, and embed secure-by-design and secure-by-default practices into the development lifecycle. [1] [3]
- Prepare technical documentation and the right conformity assessment route for CE marking ahead of the December 2027 deadline. [1] [5]
- Review contracts and due diligence arrangements with EU distributors and importers, who carry shared obligations under the CRA. [1] [4] [5]
How Espria helps
Espria Remedi8, our closed-loop automated vulnerability remediation platform, is built for exactly this challenge. Continuous vulnerability scanning through Tenable identifies exposure across the estate; automated remediation and patching through NinjaOne closes it down; and the closed-loop process leaves a documented, auditable evidence trail – the same evidence base clients need for CSIRT and ENISA reporting under the CRA.
Alongside this, our expertise across the Microsoft stack: Azure, Microsoft 365, Dynamics 365 and Business Central – helps clients harden the environments their products and services run on, while HaloPSA-tracked service delivery gives a clear, timestamped record of remediation activity that stands up to audit.
The CRA deadlines are fixed, and the September 2026 reporting obligation is now close. [1]
Espria clients who want to understand their exposure, or who need help building compliant vulnerability handling and reporting processes, should speak to their account manager or contact the Espria team directly.
Or join us at our Cyber Intelligence Briefing on 24th September at Corpus Christi College, Cambridge, we’ll look at how AI is changing vulnerability discovery, why remediation is becoming harder, and what IT leaders should prioritise next.
Register for our Cyber Intelligence Briefing here.
Sources
[1] European Commission, Shaping Europe’s Digital Future – Cyber Resilience Act summary of the legislative text (digital-strategy.ec.europa.eu/en/policies/cra-summary)
[2] Crowell & Moring, “EU Cyber Resilience Act: September 11, 2026 Reporting Deadline” (crowell.com)
[3] Black Duck, “EU Cyber Resilience Act: CRA Deadlines, Reporting, and Compliance Guide” (blackduck.com)
[4] HLC, “EU Cyber Resilience Act: Key 2026 milestones toward CRA compliance” (hlc.com)
[5] Star Insights, “The Cyber Resilience Act: what it means, who it applies to and how to prepare” (star.global)
[6] EU Cyber Laws, “CRA Penalties and Sanctions” (eu-cyber-laws.com/cra/penalties)
[7] SysGroup Insights, “MSPs on Notice: The Cyber Security and Resilience Bill Explained” (sysgroup.com) – for context on the separate UK Bill
You may be interested in
From AI Experimentation to Real Business Outcomes: Our Takeaways from Microsoft Frontier Tour London
This week, Pete Graham, Microsoft Business Manager at Espria, attended Microsoft Frontier Tour London alongside members of the wider Espria team to hear directly from Microsoft leaders, partners and customers about the future of artificial intelligence. Having attended Microsoft’s AI Tour last year, Pete was interested to see how the conversation had evolved over the past 12 months. What became clear throughout the day was that the discussion around AI has matured significantly. A year ago, many organisations were still asking what AI could do. Today, the focus is increasingly on how to adopt it…
Critical PHP vulnerabilities: do you know who owns the fix?
When websites and applications sit with different teams and suppliers, the first challenge is knowing who needs to act. Critical vulnerabilities have been disclosed affecting PHP, a technology widely used across websites, web applications and other software products. The technical advice is clear: identify affected systems and apply the available updates. But for many organisations, the first challenge is understanding where PHP is being used, who manages those systems and who is responsible for taking action. To help you identify potential exposure, we have created a PHP Security Checker to determine whether your systems have…
Beyond the Filing Cabinet: What Document Management Actually Saves You
Document Management for Small Offices with DocuWare For many small offices, document management still means a filing cabinet, a shared drive with inconsistent folder names, and a lot of time spent searching for the one contract or invoice somebody needs right now. DocuWare replaces that with a structured, searchable system that sits behind your everyday paperwork. What does DocuWare mean in practice? Giving Office Managers time back For an Office Manager who is often the person holding the whole administrative process together, this is time back. Fewer interruptions to find a document for a colleague,…
Copilot vs. Claude
Why Microsoft 365 Copilot fits every day work A plain-English guide for people trying AI at work: what Copilot does, how it differs from a separate assistant such as Claude and where to start. The short answer Claude is a separate AI workspace. Copilot sits inside the Microsoft apps many teams already use and can work with the emails, files and meetings each person is allowed to access. A separate assistant helps when: Copilot helps when: – You need help creating or developing content from scratch. – The task is focused research, reasoning or code….
Microsoft is changing Copilot billing. Here’s how to stay in control of AI costs
From 1 December 2026, new Microsoft 365 Copilot Business purchases through CSP will come with usage-based billing already configured. At first glance, that might sound like another variable cost for IT and finance teams to manage. But it also gives businesses a practical way to access the next generation of Copilot experiences while retaining control over who can use them, how much they can spend and where that money goes. This matters because Copilot is changing. New experiences such as Copilot Cowork are designed to carry out larger, multi-step pieces of work. That creates more…
Phishing just got personal
AI-powered phishing attacks are becoming harder to detect, with increasingly sophisticated emails bypassing traditional security controls. As a result, organisations are placing greater focus on Human Risk Management, recognising employee behaviour as a measurable cybersecurity risk. SecureLearn, powered by KnowBe4 and fully managed by Espria, helps businesses reduce human risk through continuous security awareness training, phishing simulations, targeted coaching, and board-ready reporting that demonstrates improvement over time.