Glossary
The vocabulary of the EU Cyber Resilience Act in plain English — products with digital elements, substantial modification, support periods, the reporting clocks and the rest of the terms the regulation turns on.
These are working definitions written for people implementing Regulation (EU) 2024/2847, not the legal wording and not legal advice. Where an answer turns on the exact text, read it at the source: Official text on EUR-Lex.
A
- Actively exploited vulnerability
A vulnerability in a product with digital elements that someone has demonstrably used to compromise a system, without the authorisation of whoever owns it. This is the trigger for the reporting clocks: it is the exploitation, not the severity score, that starts them.
See also Reporting clocks, Severe incident.
- Annex I
The essential cybersecurity requirements, in two parts. Part I is about the properties of the product itself — how it is designed, built and shipped. Part II is about the manufacturer's vulnerability handling processes, which continue for the whole support period.
See also Essential cybersecurity requirements, Vulnerability handling requirements.
C
- CE marking
The mark affixed to a product to declare that it meets the applicable EU requirements, including the CRA's. Under this regulation it claims something about the manufacturer's processes as well as the product: affixing it asserts that vulnerability handling is in place, not only that the product shipped secure.
See also EU declaration of conformity, Conformity assessment.
- Conformity assessment
The procedure by which a manufacturer demonstrates that a product meets the essential cybersecurity requirements. Which procedure is available depends on how the product is classified — most products can be self-assessed, while the important and critical categories push you towards a third party.
See also Internal control, Notified body, Important products with digital elements.
- Coordinated vulnerability disclosure
A published policy and a working route for receiving vulnerability reports from outside your organisation, and for handling them through to a fix. Annex I requires manufacturers to have one; in practice it means a monitored contact address, a stated response expectation and a disclosure timeline you can actually keep.
See also Vulnerability handling requirements, Security update.
- Critical products with digital elements
The narrowest classification tier, listed in Annex IV, covering products whose compromise would have the widest knock-on effects — hardware devices with security boxes, smart meter gateways, smartcards and similar. The Commission can require these to be certified under a European cybersecurity certification scheme.
See also Important products with digital elements, Conformity assessment.
- CSIRT designated as coordinator
The national Computer Security Incident Response Team that receives your reports of actively exploited vulnerabilities and severe incidents. Which one you report to follows from where you are established, and reports reach it and ENISA through the single reporting platform.
See also Single reporting platform, ENISA.
- Cyber Resilience Act
Regulation (EU) 2024/2847, which sets cybersecurity requirements for products with digital elements placed on the EU market. It puts obligations on manufacturers, importers and distributors covering the whole life of a product — secure design, vulnerability handling for a defined support period, and reporting when something is being exploited.
See also Product with digital elements, Key dates.
D
- Distributor
Anyone in the supply chain, other than the manufacturer or the importer, who makes a product with digital elements available on the EU market. The duties are checks rather than engineering: confirm the CE marking and documentation are there, and stop distribution and inform the authorities when you have reason to believe a product is not compliant.
See also Importer, Manufacturer, Making available on the market.
- Due diligence
The obligation on a manufacturer to exercise care over the third-party components it integrates, including free and open-source software. It does not make you responsible for someone else's code, but it does mean knowing what is in the product, whether the component is still maintained, and how a fix would reach your users.
See also SBOM, Free and open-source software.
E
- ENISA
The European Union Agency for Cybersecurity. Under the CRA it receives notifications alongside the national CSIRTs, operates the single reporting platform, and publishes technical guidance and reports on the vulnerabilities and incidents reported to it.
See also CSIRT designated as coordinator, Single reporting platform.
- Essential cybersecurity requirements
The baseline properties every product with digital elements has to ship with: no known exploitable vulnerabilities, a secure-by-default configuration, protection of data in transit and at rest, minimised attack surface, and the ability to receive security updates. They are outcomes rather than prescriptions — how you meet them is yours to argue in the technical documentation.
See also Annex I, Technical documentation, Harmonised standard.
- EU declaration of conformity
The document in which the manufacturer takes sole responsibility for the product meeting the applicable requirements. It names the product, the legislation it is declared against and the standards applied, and it has to be drawn up before the CE marking goes on.
See also CE marking, Technical documentation.
F
- Free and open-source software
Software whose source is openly shared and freely modifiable and redistributable. Supplying it outside a commercial activity falls outside the regulation's obligations; the questions in practice are where a project's funding, support offering or corporate backing crosses into commercial activity, and where a steward's lighter duties begin.
See also Open-source software steward, Due diligence.
H
- Harmonised standard
A European standard developed under a Commission request and cited in the Official Journal, which carries a presumption of conformity: build to it and the corresponding requirement is taken as met. Until the CRA's standards land, manufacturers have to demonstrate conformity against the requirements directly.
See also Essential cybersecurity requirements, Conformity assessment.
I
- Important products with digital elements
The middle classification tier, listed in Annex III as class I and class II. These are products whose function carries a higher risk — password managers, network management tools, boot managers, firewalls, microprocessors and the like — and the class determines how much of the conformity assessment you can still do yourself.
See also Critical products with digital elements, Conformity assessment, Notified body.
- Importer
Someone established in the EU who places a product from outside the EU on the Union market. You are responsible for checking before you ship that the manufacturer did the conformity assessment, that the documentation and CE marking are in place, and for keeping the authorities informed when they are not.
See also Distributor, Manufacturer, Placing on the market.
- Internal control
The self-assessment route: the manufacturer checks its own product against the requirements, compiles the technical documentation and draws up the declaration of conformity without a third party. It is the default for products that are not classified as important or critical, and it stays available for much of class I where harmonised standards have been applied in full.
See also Conformity assessment, Notified body, Harmonised standard.
K
- Key dates
The regulation entered into force on 10 December 2024. Member states could notify conformity assessment bodies from 11 June 2026; the Article 14 reporting obligations have applied since 11 September 2026; and the remaining obligations apply from 11 December 2027.
See also Legacy products, Reporting clocks.
L
- Legacy products
Products placed on the market before the regulation fully applies. The transitional provisions leave them outside most of the obligations — until they are substantially modified, at which point the modified product is treated as newly placed on the market and has to meet the requirements in full. Reporting is the exception that catches everyone: an actively exploited vulnerability in a legacy product carries the same Article 14 clocks.
See also Substantial modification, Reporting clocks, Key dates, Placing on the market.
M
- Making available on the market
Supplying a product for distribution or use on the EU market in the course of a commercial activity, whether paid or free. Every supply after the first one is a making available; the first one is the placing on the market, and the distinction decides which obligations attach to whom.
See also Placing on the market, Distributor.
- Manufacturer
Whoever develops or manufactures a product with digital elements, or has one developed for them, and markets it under their own name or trademark. Nearly every substantive obligation lands here: the essential requirements, vulnerability handling, the support period, the technical documentation and the reporting duties.
See also Importer, Distributor, Substantial modification.
The national authority that enforces the regulation on products already in circulation. It can require information and documentation, order a product to be brought into conformity, restrict its availability or have it withdrawn, and it is the body that applies the administrative fines.
See also Technical documentation.
N
- Notified body
An independent conformity assessment body, notified to the Commission by a member state, that carries out third-party assessment where the product's classification requires it. Capacity is the practical constraint rather than the procedure: bodies could only be notified from June 2026, and assessment slots are booked well ahead.
See also Conformity assessment, Important products with digital elements, Key dates.
O
- Open-source software steward
A legal person, other than a manufacturer, that systematically and sustainedly supports the development of open-source products intended for commercial activity — typically a foundation supporting projects it does not sell. Stewards carry a lighter, tailored set of duties: a documented security policy, cooperation with authorities, and reporting of actively exploited vulnerabilities in the products they support.
See also Free and open-source software, Manufacturer.
P
- Placing on the market
The first time a product with digital elements is made available on the EU market. It is the moment the product has to be compliant, and the anchor for most of the regulation's timing — including whether a product counts as legacy and when a substantial modification resets the clock.
See also Making available on the market, Substantial modification, Legacy products.
- Product with digital elements
Any software or hardware product, and its remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Components placed on the market separately — a library, a module, a chip — are products in their own right.
See also Remote data processing solution, Cyber Resilience Act.
R
- Remote data processing solution
Data processing at a distance that the manufacturer designs and develops, and without which the product could not perform one of its functions. It is what pulls a back end inside a hardware product's regulatory boundary — and the reason a hosted service can be in scope even though software-as-a-service generally is not.
See also Product with digital elements, Manufacturer.
- Reporting clocks
Three deadlines, running from the moment you become aware. An early warning goes to the CSIRT and ENISA within 24 hours and a fuller notification within 72 hours. The final report then follows on its own trigger: within 14 days of a corrective or mitigating measure becoming available for an actively exploited vulnerability, or within one month of the 72-hour notification for a severe incident — resolved or not.
See also Actively exploited vulnerability, Severe incident, Single reporting platform.
S
- SBOM
A software bill of materials: a machine-readable inventory of the components in a product, covering at least the top-level dependencies. Annex I requires manufacturers to produce and keep one; it does not have to be published, but it has to be available to the authorities and current enough to answer what is affected when a component vulnerability lands.
See also Technical documentation, Due diligence.
- Security update
A fix distributed to address a vulnerability, which the regulation expects to be free of charge, delivered without delay and — where technically feasible — separable from functional updates, so that taking the fix does not force a feature change. Automatic delivery with an opt-out is the default the requirements point at.
See also Support period, Vulnerability handling requirements.
- Severe incident
An incident affecting the security of a product with digital elements that negatively affects, or is capable of negatively affecting, the product's ability to protect the availability, authenticity, integrity or confidentiality of data or functions. Like an actively exploited vulnerability, it carries the reporting clocks.
See also Reporting clocks, Actively exploited vulnerability.
- Single reporting platform
The reporting endpoint ENISA operates, through which notifications reach the relevant national CSIRT and ENISA at once. It is a routing layer rather than an extra obligation — you file once, and it reaches the authorities that need it.
See also Reporting clocks, CSIRT designated as coordinator, ENISA.
- Substantial modification
A change to a product after it has been placed on the market that affects its compliance with the essential requirements, or that changes the intended purpose. It makes the modified product newly placed on the market: conformity assessment, documentation and the CE marking all have to be revisited for what changed.
See also Placing on the market, Legacy products, Security update.
- Support period
The period during which the manufacturer has to handle vulnerabilities and ship security updates. It reflects how long the product is reasonably expected to be in use and is at least five years, shorter only where the expected lifetime is genuinely shorter — and it has to be stated to the buyer before purchase.
See also Security update, Vulnerability handling requirements.
T
- Technical documentation
The evidence file behind the declaration of conformity: what the product is, how it was designed and built, the risk assessment, how each essential requirement is met, the SBOM and the vulnerability handling processes. It is drawn up before the product is placed on the market, kept current for the support period, and handed over when an authority asks.
See also EU declaration of conformity, SBOM, Market surveillance authority.
V
- Vulnerability handling requirements
The process side of Annex I: identify and document components, address vulnerabilities without delay, test regularly, publish information about fixed vulnerabilities, run a coordinated disclosure policy, make reporting easy, distribute updates securely and ship fixes promptly and free of charge. They apply throughout the support period, not only at release.
See also Annex I, Coordinated vulnerability disclosure, Support period.
Missing a term? Ask on the community board and it will be added.