Secure updates
The device has to be able to receive security updates. The support period is what you set and publish.
Connected devices
Get your connected device ready for the CRA's 24-hour report
On a delivery date agreed in writing, we write the Article 14 runbook across your firmware, app and cloud back end, name who decides, and run one drill with your team. About 4 hours of your engineers' time, at a fixed price in writing.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Firmware, app and cloud as one product · Reporting applies now · Class recorded with your adviser
What the CRA means for connected devices
One product, several pieces
A connected device is not only the box. The software it needs is part of the product.
Anyone who places a product with digital elements on the EU market is in scope, wherever the company is based. For a connected device that usually means the firmware, the app and the cloud back end, when the product needs that back end to work. An importer or a brand that sells under its own name can take on the manufacturer's duties.
Reporting under Article 14 has applied since 11 September 2026, including to products you already sell. The security requirements, the documentation, conformity assessment and CE marking apply from 11 December 2027. From that date the CRA also replaces the RED cybersecurity rules that have applied since 1 August 2025.
Some products, such as routers or smart-home security products, may need a third-party assessment. We record the class you and your adviser decide.
The duties that weigh most
Updates, the support period, and a bill of materials that includes the firmware and the parts you buy.
The whole product
Firmware, app and cloud back end are treated as one product when the device needs them.
SBOMs
A bill of materials per release, including firmware and supplier parts, not only the app.
Reporting now
An actively exploited vulnerability is already on the 24-hour and 72-hour clocks, including for devices you shipped years ago.
Reporting: applies since 11 Sep 2026 · Everything else: 11 Dec 2027 · Full timeline
What usually comes first
Reporting first. The file and the SBOM follow, and each step is optional.
Usually first
- Name who would report, and practise the 24-hour and 72-hour stages.
- Publish a security contact.
- Treat firmware, app and back end as one product in that runbook.
Can follow
- An SBOM per release, including supplier parts.
- Vulnerability handling for the support period.
- The technical file before December 2027.
Related
Questions
How does the price work?
One fixed price for your product, in writing, the same day you ask. It only changes if the scope does.
Do you see our real vulnerability data?
No. The drill runs on sample data. We sign an NDA or DPA before you share anything sensitive.
We already work with a test lab or consultant.
That's fine. We set up the reporting process and they keep the legal and assessment work.
We're outside the EU but sell there.
Article 14 applies to products on the EU market, wherever the maker is based.
What about RED and EN 18031?
From 11 December 2027 the CRA replaces the RED cybersecurity rules that have applied since 1 August 2025.
Do devices we sold years ago count?
Yes for reporting. Article 14 covers products already on the market.
Is our cloud back end covered?
Yes, when the product needs it to work. The back end is then part of the product with the firmware and the app, not a separate service you can leave out of the file.
Do routers or smart-home security products need a third-party assessment?
Some connected products fall into classes that need a third-party assessment. We can build a guided check that records your decision. Your adviser confirms the class.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.