Cyber Resilience Act for SMEs: A Lean Roadmap

Cyber Resilience Act for SMEs: Obligations and Priorities

Last updated: 2026-10-09

Does the CRA apply to your business? Yes - the reporting obligation already applies.

The Cyber Resilience Act (Regulation (EU) 2024/2847) includes no size exemption for manufacturers. If you place a product with digital elements - hardware or software - on the EU market, the obligations apply to you in principle. Whether you have 10 or 10,000 employees.

Micro and small enterprises benefit from targeted relief, for example a simplified format for the technical documentation (Article 33(5)). Whether Article 64(10) exempts them from fines for a missed 24-hour early warning is, on its wording, a question of interpretation, because the provision only derogates from paragraphs 3 to 9; recital 120 points that way. The reporting obligation applies regardless of company size.

The good news: with the right starting point, the CRA can be addressed in a structured and proportionate way - if you start now.

Two deadlines that matter

Date	What applies from then on?	Priority for SMEs
11 September 2026	Reporting obligations for actively exploited vulnerabilities and severe security incidents	Immediate - already applies, operational processes must be in place
11 December 2027	Full product requirements: security by design, SBOM, CE marking, technical documentation, EU declaration of conformity	Medium to high - allow for lead time in product development

The first deadline, 11 September 2026, has already passed and is therefore the more urgent one. It requires working processes, not a finished product dossier. If you have no defined workflow for when a vulnerability is reported or a security incident occurs, you cannot reliably meet the reporting obligation today.

What you must have had in place operationally since September 2026

Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and severe security incidents via the single reporting platform, simultaneously to the CSIRT designated as coordinator and to ENISA:

24 hours: early warning without undue delay and in any event within 24 hours of becoming aware
72 hours: notification without undue delay and in any event within 72 hours, with the general information available and the corrective or mitigating measures taken
Final report: 14 days after a corrective measure is available (actively exploited vulnerabilities); one month after the 72-hour notification (severe security incidents)

Check in advance whether these are in place: a defined point of contact for security reports, an escalation path and a template for the final report. Building these processes takes time but can be kept lean.

More on reporting timelines and channels: CRA Reporting Obligations since 11 September 2026.

Typical pitfalls for SME manufacturers

"We only make software - surely this doesn't apply to us."

Software is a product with digital elements. It falls under the CRA if its intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). Purely offline software with no data connection may be out of scope; the boundary needs to be assessed case by case.

"We're too small to need a notified body."

Standard products can demonstrate conformity through self-assessment. However, this depends on the product category. Important products (Annex III, Class I and II) are subject to stricter requirements - up to and including mandatory involvement of a notified body. Which route applies to your product should be clarified early. More: CRA Product Classes: Classification and Conformity Paths.

"The SBOM obligation doesn't kick in until 2027 - that can wait."

Yes and no. The obligation applies from December 2027. Building an SBOM from the build in a commonly used machine-readable format that covers at least the top-level dependencies takes time if dependencies have never been tracked systematically. More on formats and requirements: SBOM Requirements in the CRA.

"We also sell outside the EU - the CRA only applies domestically."

The CRA is triggered by making a product available on the EU market. If you sell in the EU, it may apply if the other conditions are met - regardless of where your headquarters are located or where else you export.

Prioritised roadmap: what to tackle first when budget and time are limited

No SME needs to do everything at once. The following prioritisation is based on the deadlines and on risk.

Roadmap for SMEs under the Cyber Resilience Act in two phases; there is no size exemption for manufacturers, the order follows the deadlines. Phase 1, now, processes before documents, because the reporting obligation has applied since 11 Sep 2026: 1 clarify applicability and role, 2 classify the product, 3 build the reporting process with point of contact, escalation path, report templates and access to the reporting platform, 4 track vulnerabilities in third-party components. Phase 2, by 11 Dec 2027, close the product gaps, full requirements from 11 Dec 2027: 1 risk assessment and security by design, 2 SBOM in a commonly used machine-readable format, 3 technical documentation, 4 conformity assessment, self-assessment or notified body depending on the class, 5 user information under Annex II. Reporting deadlines under Article 14: 24 hours early warning, 72 hours notification, final report after 14 days or one month. Relief for micro and small enterprises: a simplified format for the technical documentation (Art. 33(5)), the Commission sets the form by implementing act; an exemption from fines for a missed 24-hour early warning (Art. 64(10)), whose scope is open to interpretation. The reporting obligation itself applies regardless of size. Source: Articles 14, 33(5) and 71(2) of Regulation (EU) 2024/2847; final report no later than 14 days after a corrective or mitigating measure is available for vulnerabilities, one month after the notification for incidents. — SME roadmap: the reporting process first, then the product requirements by December 2027.

Phase 1 - Immediately: processes before documents (reporting obligation applies since September 2026)

Clarify applicability: Does the CRA cover your product? What role do you play (manufacturer, importer, distributor)? → Interactive Applicability Check
Classify your product: Standard, important Class I, important Class II, or critical? This determines the conformity path.
Build the reporting process: Designate a point of contact, define the escalation path, create report templates, and prepare access to the CRA Single Reporting Platform.
Introduce vulnerability tracking: Who reports what to whom internally? How are known vulnerabilities in third-party components monitored?

Phase 2 - By December 2027: systematically close product gaps

Risk assessment and security by design: Cybersecurity risk assessment covering planning, design, development, production, delivery and maintenance - can be anchored in existing processes.
Build the SBOM: Compile your software bill of materials in a commonly used machine-readable format covering at least the top-level dependencies (BSI TR-03183-2 requires CycloneDX ≥ 1.6 or SPDX ≥ 3.0.1), observe the retention obligation (at least ten years or the support period, whichever is longer). Request a gap report: have your SBOM assessed for CRA readiness
Build technical documentation: The foundation for CE marking and the EU declaration of conformity.
Carry out the conformity assessment: Depending on the product class, self-assessment or involvement of a notified body.
User information (Annex II): Provide security-relevant product information to end users.

What Blackfort Technology handles for SME manufacturers

Blackfort Technology supports small and mid-size manufacturers from the initial scoping to a prepared conformity assessment, with a scope that fits the size of your company.

Applicability and product class analysis: technical assessment of whether and to what extent your products fall under the CRA, legal questions flagged for your legal department
Reporting process setup: Building a lean PSIRT (Product Security Incident Response) process that covers the reporting obligation in force since September 2026
SBOM gap report: Assessing your software bill of materials against CRA requirements, tooling recommendation
Technical documentation: Creating or reviewing the documents required for CE marking
Conformity assessment support: Preparing for self-assessment or coordinating with a notified body

Blackfort Technology is represented in the AI security expert group of the Alliance for Cyber Security through its managing director, who is co-author of the guideline on penetration testing of large language models published there. Blackfort Technology brings its hands-on experience from PKI, DORA, NIS2, ISMS and vulnerability management projects directly into the CRA work.

Frequently asked questions

Does the Cyber Resilience Act also apply to very small businesses with fewer than 10 employees?+

Yes. The CRA includes no size exemption for manufacturers. Micro and small enterprises benefit from targeted relief, for example a simplified format for the technical documentation (Article 33(5)). Whether Article 64(10) exempts them from fines for a missed 24-hour early warning is, on its wording, a question of interpretation, because the provision only derogates from paragraphs 3 to 9; recital 120 points that way. The reporting obligation itself applies regardless of company size. Anyone placing products with digital elements on the EU market must in principle meet the requirements.

We build a SaaS product - does software without hardware fall under the CRA?+

Pure SaaS offerings are in principle not covered by the CRA; cloud services such as SaaS fall under the NIS2 Directive (recital 12). The CRA covers software made available as a product, including its remote data processing: a backend that you design and develop yourself or under your responsibility and without which an app or device could not perform one of its functions is part of the product (Article 3(1) and (2)). The boundary needs to be assessed case by case.

What happens if we fail to meet the reporting obligation that has applied since September 2026?+

Breaches of CRA requirements can result in significant fines. For infringements of the essential cybersecurity requirements (Annex I) and certain manufacturer and reporting obligations (including Articles 13 and 14), the CRA provides for fines of up to 15 million euros or 2.5 percent of total worldwide annual turnover, whichever is higher. Company size is taken into account when setting the fine (Article 64(5)). Whether Article 64(10) exempts micro and small enterprises from fines for the 24-hour early warning is a question of interpretation; recital 120 points that way. The detailed penalty rules are laid down by the Member States (Article 64(1)); in Germany a separate implementing act is intended for this.

Do we have to build a dedicated security team to meet the reporting obligation?+

No. The CRA requires a contact address for vulnerability reports and a single point of contact (Annex I Part II(6), Article 13(17)) and that you report on time. In practice that means a named contact, a defined escalation path and access to the single reporting platform. How you organise this internally - as part of your IT lead's role, through an external service provider, or as a dedicated PSIRT - is up to you.

How much effort does a software bill of materials (SBOM) take for a typical SME product?+

This depends heavily on the complexity of your dependencies. SBOM generators in the build (such as the CycloneDX plugins for package managers) automate much of the collection; tools such as Dependency-Track then analyse the SBOM against vulnerability data. The effort lies less in the technical setup and more in the initial inventory of unknown or poorly documented third-party components. Our SBOM gap report shows you precisely where the gaps are.

We sell mainly in the US - do we still need to become CRA-compliant?+

If you also offer your product on the EU market or have customers in the EU, it may fall under the CRA if it meets the other conditions. The CRA is triggered by making a product available on the EU internal market, not by where the company is headquartered. Those who sell exclusively outside the EU and have no EU distribution channel are in principle out of scope.

Sources

This content provides general technical and organizational information on the Cyber Resilience Act (Regulation (EU) 2024/2847) and does not constitute legal advice (no legal services within the meaning of the German RDG).

Cyber Resilience Act for SMEs: Obligations and Priorities