The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For electronics and IoT makersNACE 26, all of the EU

The CRA clock is running. Keep every device's file current.

The Cyber Resilience Act, NIS2 and the Data Act each ask something different of a company that makes connected electronics.

Start your compliance system Check if the CRA applies to you
Example data

The rules that reach you

What reaches a device maker, and from when

One law covers each product, one covers the company, and one covers the data your devices produce.

Cyber Resilience Act

Regulation (EU) 2024/2847 · Products with digital elements

Every product

Every product with digital elements that connects to a device or a network, placed on the EU market.

24 hEarly warning of an actively exploited vulnerability, products already sold includedArt 14
Class IRouters, modems, switches and smart home security products are important productsAnnex III
CE markOnly after the technical documentation, the conformity assessment and the declarationArt 13(12)
Art 13Reporting since In full from

NIS2

Directive (EU) 2022/2555

Medium-sized and up

Annex II point 5(b) lists the manufacture of computer, electronic and optical products, NACE division 26.

Annex II, 5(b)Art 2(1)Since

Data Act

Regulation (EU) 2023/2854

New connected products

Connected products placed on the market after 12 September 2026 must let users reach their data; micro and small makers are outside Chapter II.

Art 3(1)Art 7(1)By design since

In numbers

The clock, the classes and the field

until the Cyber Resilience Act applies in full.

Source: Regulation (EU) 2024/2847, Article 71(2)

23

kinds of product are important under Annex III, routers, modems and smart door locks among them.

Source: Regulation (EU) 2024/2847, Annex III

about2,274

makers of electronic components and boards in the EU have 10 to 249 staff.

Source: Eurostat business statistics 2024, NACE 26.1, partly estimated

What StandardOS does for a device maker

One file per device, and the company file beside them

Every tile is a screen in the product today.

One technical file per product

Each product's tier, technical documentation, SBOM and support period, kept current as it changes.

The Article 14 clocks, counted

From the moment you become aware of an actively exploited vulnerability, each report's deadline is on screen.

Every rule as a checklist

Each framework on this page as requirement rows, with an owner, the evidence and a review date.

Evidence from your own stack

12 read-only integrations, Microsoft Entra ID and Intune among them, read on a schedule.

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 3 on this page, and 24 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Or one file, once: CRA technical file, €2,000 · introductory price until 30 Nov 2026See the pack

Done for you: CRA technical file, done for you, €2,900See the offer

Questions

What device makers ask first

Short answers, each with the article it rests on.

Is our router an important product?

Yes. Annex III, class I lists routers, modems intended for the connection to the internet, and switches. You may assess conformity yourself only by applying harmonised standards, common specifications or a certification scheme in full; otherwise a notified body does.

Annex IIIArt 32(2)
Do we report vulnerabilities in devices sold years ago?

Yes. The Article 14 reporting duty covers products placed on the market before 11 December 2027 too.

Art 14Art 69(3)
Does NIS2 apply to an electronics maker?

If you are medium-sized or larger and work in NACE division 26, Annex II lists you, and you are an important entity unless your state designates you essential.

Annex II, 5(b)Art 3(2)
What does the Data Act ask of a new device?

Design it so users can reach the data it generates, easily and securely, and have them told before they buy what data it produces.

Art 3(1)Art 3(2)
Are we too small for the Data Act?

Micro and small enterprises are outside Chapter II, as long as they have no partner or linked enterprise above that size.

Art 7(1)

Start with one device. Add the rest when ready.

7 days free, no card and no sales call.

Start your compliance system Check if the CRA applies to you

This page in:DeutschFrançaisNederlandsEspañolDansk