Copla, the compliance platform provider, has launched a dedicated framework for the EU’s Cyber Resilience Act (CRA), as businesses selling software and connected devices into Europe face a deadline that could lock unprepared vendors out of the market entirely.
The new framework splits the CRA’s secure-by-design and vulnerability-handling obligations into discrete tasks, maps out a preparedness plan and supplies templates for both the required technical documentation and the EU Declaration of Conformity. It joins existing frameworks on the platform covering DORA, NIS2, ISO 27001, SOC 2 and PCI DSS.
The CRA extends the CE mark, the safety label familiar from consumer goods such as toys, kettles and chargers, to software for the first time. Any business offering a “product with digital elements” in the EU, whether an app, a platform or a connected device, must demonstrate compliance with new security rules and issue a formal declaration of conformity before applying the mark.
Firms that cannot do so will be barred from selling, a penalty that goes well beyond a financial sanction.
The regulation imposes five central obligations. Products must be secure by design and by default, and manufacturers must manage vulnerabilities throughout the support period.
Technical documentation must evidence how the security rules are satisfied, an EU Declaration of Conformity must be signed, and compliant products must display the CE mark. Separately, reporting duties for open-source software stewards under Article 24(3) come into force in step with these core requirements.
Evidence suggests many companies are behind. ENISA’s first SME survey on the CRA, published in June 2026 and covering 194 organisations in 31 countries, found that 66% of respondents knew of the regulation. However, only roughly one in three used a software bill of materials (SBOM), while incident response and product lifecycle management ranked as the weakest capability for businesses of all sizes.
ENISA cautioned that its voluntary sample probably leans towards SMEs already engaged with the issue, meaning actual readiness could be lower.
From 11 December 2027, products lacking a valid declaration of conformity and CE mark cannot lawfully enter the EU market, and national market surveillance authorities will have powers to demand withdrawals or recalls. Breaches of the core security rules can also attract penalties of up to €15m or 2.5% of global annual turnover, whichever figure is greater.
Some obligations already apply: since 11 September 2026, manufacturers have been required to notify ENISA and national CSIRTs of actively exploited vulnerabilities and severe incidents, issuing an early warning within 24 hours. That is precisely the capability ENISA’s research identified as the weakest.
Copla CEO and co-founder Aurimas Bakas said, “ENISA’s findings show that awareness is there, but the practical groundwork often isn’t yet. An SBOM, a vulnerability handling process and an incident response plan take time to put in place properly, and the reporting obligations already apply today. Companies that start now still have a realistic window to get there before December 2027, and that’s what we want to help them do.”
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
