BY NEURABYTE
FRAMEWORKS/SECURITY/CYBER RESILIENCE ACT
CRA
SECURITY · European Union

Cyber Resilience Act

Security requirements for products with digital elements sold in the EU.

The Cyber Resilience Act entered into force in December 2024. It requires manufacturers of hardware and software to design for security, handle vulnerabilities through the support period, and report actively exploited vulnerabilities. Reporting obligations apply from September 2026; the main requirements apply from December 2027.

AT A GLANCE
ISSUEREuropean Union REGIONEU market CATEGORYSecurity CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Software and hardware manufacturers placing products on the EU market
02Importers and distributors of those products
03Vendors whose shipped products include agents or agent runtimes
02. KEY REQUIREMENTS

The parts of Cyber Resilience Act that touch what agents do.

Annex I Part I: Security by design
Products ship without known exploitable vulnerabilities, with secure defaults and access control.
Annex I Part II: Vulnerability handling
Manufacturers document components, including an SBOM, and fix vulnerabilities without delay.
Art. 14: Reporting
Actively exploited vulnerabilities and severe incidents are reported to ENISA and the CSIRT within 24 hours.
Logging
Products record and monitor relevant internal activity.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against Cyber Resilience Act. Where there is no evidence, the report says gap.

LORE CONTROL CYBER RESILIENCE ACT REFERENCE
Blocking authorization gateAnnex I Part I, access control
Signed, hash-chained receiptsAnnex I Part I, logging
Offline installer SBOMAnnex I Part II (1)
Signed update mediaAnnex I Part I, secure updates
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

CE marking, conformity assessment and the support period are manufacturer obligations.
Vulnerability disclosure policy and ENISA reporting are your program.
05. QUESTIONS
Does the CRA cover SaaS?
Pure SaaS generally falls under NIS 2 instead. Software you ship to customers, including self-hosted agent platforms, is in scope.
When do obligations start?
Reporting from 11 September 2026; the remaining requirements from 11 December 2027.
How does Lore help?
Receipts evidence access control and logging, and the offline installer ships with a CycloneDX SBOM and signed media.
← PREVIOUS21 CFR Part 11 ALL FRAMEWORKS NEXT →FIPS 140 / CMVP
CYBER RESILIENCE ACT · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for Cyber Resilience Act tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.