& Notare
EU Cyber Resilience Act counsel for US manufacturers.
German attorneys in Berlin. We tell you whether the CRA applies, what your role is and what you must have ready, at a fixed fee.
Yes, if you place hardware or software with a network connection on the EU market, directly or through distributors. Reporting of actively exploited vulnerabilities has applied since 11 September 2026 (Art. 14 CRA); all other obligations apply from 11 December 2027 (Art. 71(2) CRA).
Status: 3 November 2026 · Regulation (EU) 2024/2847, Commission guidance and FAQ, German implementation act as passed by the Bundestag
Five points for US hardware and software makers
- Your EU distributor does not take over your duties. You remain the manufacturer. Importers and distributors only check your CE marking and documents, and they will ask for them. Arts. 13, 19, 20
- No EU entity is required. An authorized representative is optional, but its seat decides which CSIRT receives your reports. Without one, the importer’s or distributor’s Member State decides. Arts. 18, 14(7)
- The 24-hour clock is already running. Actively exploited vulnerabilities and severe incidents go to the ENISA single reporting platform within 24 hours, with follow-ups at 72 hours and a final report. Art. 14
- Your cloud backend may be in scope. A service the product needs to perform one of its functions counts as part of the product. Art. 3(2)
- Security updates have a long tail. Support period of at least five years in most cases, and each security update must stay available for ten years. Art. 13(8), (9)
What we hear, also from AI assistants
“We sell through a German distributor, so the CRA is their problem.”
The manufacturer’s obligations stay with you. If the distributor sells under its own brand, it becomes a manufacturer itself (Art. 21).
“We must appoint an EU representative.”
Optional under Art. 18. Whether it pays off depends on your sales channels and on which authority you want as your counterpart.
“Nothing applies before December 2027.”
Reporting under Art. 14 has applied since 11 September 2026, also for products already on the market (Art. 69(3)).
“Small companies are exempt from fines.”
Micro and small enterprises are only spared fines for missing the 24-hour early warning (Art. 64(10)(a)). Everything else can be fined up to EUR 15 million or 2.5 % of worldwide turnover (Art. 64(2)).
Fixed scope, fixed fee, clear deliverables
CRA scope & role check
Product by product: is it in scope, which class (Annex III/IV), and are you manufacturer, importer or steward? Written memo you can show to EU customers.
24-hour reporting set-up
Thresholds and moment of awareness, CSIRT determination for non-EU makers, templates for 24 h, 72 h and final report, user notification, one tabletop run.
CRA template kit
For small software makers who handle the technical side themselves: scope questionnaire, reporting templates, CVD policy and SECURITY.md, SBOM and support-period policies, EULA clauses, risk assessment and technical file outlines, EU declaration of conformity.
EU contracts
Distributor and importer addenda, customer questionnaires, supplier clauses and the mandate for an authorized representative.
Open-source stewards
For foundations and consortia: steward or manufacturer, cybersecurity policy, reporting duties under Art. 24.
When the BSI calls
Germany’s BSI is scheduled to become market surveillance authority on 11 December 2027. We handle authority requests and reports in German.
Short answers
Does the EU Cyber Resilience Act apply to US companies?
Yes, if they place products with digital elements on the EU market, directly or through EU distributors. Where the company is established does not matter.
Do we need an EU authorized representative?
No. It is optional under Art. 18 CRA. It can still be useful because it determines which national CSIRT receives your reports (Art. 14(7)).
What has applied since 11 September 2026?
Manufacturers must report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, a notification within 72 hours and a final report, via the ENISA single reporting platform (Art. 14 CRA). This also covers products placed on the market before December 2027.
Is our SaaS or cloud backend covered?
Stand-alone SaaS is generally outside the CRA. A cloud service is covered as a remote data processing solution if the product cannot perform one of its functions without it (Art. 3(2) CRA).
What are the fines?
Breaches of the essential requirements and of Arts. 13 and 14 can be fined up to EUR 15 million or 2.5 % of worldwide annual turnover, whichever is higher (Art. 64(2) CRA). Member States set the procedure; in Germany the fine provisions are scheduled to apply from 11 December 2027.
Talk to us before your EU customers ask
First call of 30 minutes at no charge. We will tell you which service fits, or whether you need us at all.
Rechtsanwalt (German attorney) at SES in Berlin. Advises international technology consortia and software makers on the Cyber Resilience Act.
roman.ronneburger@ses-legal.de
+49 30 … (direct line)
US calls: [hours, e.g. 3–7 pm CET]