The Cyber Resilience Act for charger makers
A plain summary of what the CRA asks of manufacturers, and what you should be able to show.
Who it binds
The CRA binds manufacturers of products with digital elements placed on the EU market. A networked charger is the kind of product it’s written for.
The reporting duties bind the manufacturer. They don’t bind an operator running the charger, whose duties come from NIS2.
A pure cloud service is generally outside the CRA, unless it’s remote data processing that the product needs to perform one of its functions. Check where your back-end falls.
The reporting clock
For an actively exploited vulnerability. Reports go through ENISA’s single reporting platform.
Start
You become aware
Of an actively exploited vulnerability in your product.
Within 24 hours
Early warning
Sent through ENISA’s single reporting platform.
Within 72 hours
Vulnerability notification
General information, and any corrective measures.
Within 14 days
Final report
Counted from when a corrective or mitigating measure is available.
A severe incident affecting product security follows the same 24-hour and 72-hour steps, with a final report within one month of the notification. European Commission, CRA reporting
Two dates
11 Sep 2026
Reporting applies
Actively exploited vulnerabilities and severe incidents.
11 Dec 2027
Main obligations apply
Essential requirements, vulnerability handling and CE marking.
Fines for breaching the essential requirements or the Article 13 and 14 duties reach €15M or 2.5% of worldwide annual turnover, whichever is higher. Regulation (EU) 2024/2847, EUR-Lex
What you should be able to show
Our reading of what you’ll need to hand when the clock is running.
When you became aware, who decided, and what they knew then.
Which versions and units are affected, and how you know.
What you shipped or advised, and when it became available.
How long each product gets security updates.