Copla, a compliance platform provider, has launched a dedicated Cyber Resilience Act (CRA) framework as companies selling digital products in the EU face a December 2027 deadline that could bar non-compliant software from the market entirely.

The new framework splits the CRA’s demands around secure-by-design development and vulnerability management into discrete tasks for users to work through. It also provides a structured readiness plan, along with templates covering the technical documentation and the EU Declaration of Conformity that manufacturers will be required to produce.

Under the CRA, the CE mark already familiar from consumer goods such as toys, kettles and chargers will be extended to software. Any business offering a “product with digital elements” in the EU, whether that is an app, a platform or a connected device, must demonstrate compliance with new security rules and issue a formal declaration of conformity before it can display the mark.

The regulation sets out five central obligations: products must be built securely and ship with secure default settings, vulnerabilities must be managed throughout the support period, technical documentation must evidence compliance, an EU Declaration of Conformity must be signed, and the CE mark must be applied. Reporting duties for open-source software stewards under Article 24(3) will come into force at the same time as these main requirements.

Survey findings from ENISA point to a significant shortfall. Its first SME-focused CRA study, published in June 2026 and covering 194 organisations in 31 countries, showed that 66% of respondents knew about the regulation.

Source link