Executive Compliance Guide: Cyber Resilience Act (CRA) | Navigating EU Law

image of an outdoor balcony in an office during the golden hourimage of an outdoor balcony in an office during the golden hour

Executive Compliance Guide: Cyber Resilience Act (CRA)

Navigating EU Law

September 22, 2025

Global
Global
Global
The CRA establishes cybersecurity rules for digital products sold in the EU, covering smart devices, routers, software and industrial systems.

It requires continuous security measures and imposes fines up to €15 million or 2.5 % of turnover in case of non‑compliance. These rules apply to manufacturers, importers, distributors and non‑EU companies selling to the EU market, unless sector‑specific regulations apply. The CRA entered into force on 10 December 2024, with its main obligations applying from 11 December 2027. 

The materials on the Eversheds Sutherland website are for general information purposes only and do not constitute legal advice. While reasonable care is taken to ensure accuracy, the materials may not reflect the most current legal developments. Eversheds Sutherland disclaims liability for actions taken based on the materials. Always consult a qualified lawyer for specific legal matters. To view the full disclaimer, see our Terms and Conditions or Disclaimer section in the footer.

Guides and Reports

Navigating EU Law

Business Topics

Latest Insights

Latest News

Latest Events

Global_Website

legal updates

July 02, 2026

Legal Telescope: Building the infrastructure of tomorrow – market, regulato...

abstract digital world map with global network connections and technology background 244417364_xl

legal updates

July 02, 2026

Konexo retains its Band 1 position in the Chambers and Partner Global NewLa...

adrien-q-mH2zk9NGc-unsplash

guides and reports

July 02, 2026

Executive Compliance Guide: Cyber Resilience Act

View looking up to several modern skyscrapers

legal updates

July 01, 2026

Commercially Connected shorts - 1 July 2026

© Eversheds Sutherland 2026. All rights reserved. Eversheds Sutherland is a provider of legal and other services operating through various separate and distinct legal entities. For further information about these entities and Eversheds Sutherlands' structure please see the Legal Notice page of this website.

Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed or affiliated firms and the members of Eversheds Sutherland (Europe) Limited and Eversheds Sutherland (Africa) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global entity. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client. For further information about these Eversheds Sutherland Entities and Eversheds Sutherlands’ structure please see the Legal Notices page of this website. For information on Konexo please also see the Legal Notices page of this website.