The EU Cyber Resilience Act for US Companies

The Cyber Resilience Act applies to products with digital elements made available on the EU market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Article 2(1)). Article 2(2) to (7) excludes some products, such as medical devices and products developed exclusively for national security or defense. For an in-scope product, it does not matter where the manufacturer is established. A US company that develops or manufactures a product, or has it developed, and markets it under its own name or trademark is its manufacturer (Article 3(13)). It carries the manufacturer obligations in Article 13.

What your EU importers and customers will need

From December 11, 2027, before an EU importer places your product on the market, it must ensure that you carried out the conformity assessment, drew up the technical documentation, affixed the CE marking, and supplied the EU declaration of conformity and the Annex II user information (Article 19(2)). Your importers will ask you for this evidence.

Under the CRA, appointing an authorized representative in the EU is optional (Article 18(1)). The representative performs the tasks in its written mandate. Product design, development and vulnerability handling remain your obligations (Article 18(2)).

Key dates

• June 11, 2026: the rules on conformity assessment bodies (Chapter IV) apply.
• September 11, 2026: Article 14 reporting of actively exploited vulnerabilities and severe incidents applies. It also covers products placed on the market before December 11, 2027 (Article 69(3)).
• December 11, 2027: the rest of the Regulation applies (Article 71(2)).

How far your US evidence goes

NIST SSDF practices, Cyber Trust Mark testing, CMMC assessments, federal procurement attestations and state IoT law compliance all produce evidence you can reuse: risk assessments, secure development records, test results and vulnerability handling procedures. None of them gives a presumption of conformity with the CRA. Under Article 27, a presumption can come from harmonized standards whose references are published in the Official Journal, from Commission common specifications or from certain European cybersecurity certification schemes, and in each case only for the requirements they cover.

Products placed on the market before December 11, 2027 fall under the CRA's requirements only if they are substantially modified from that date (Article 69(2)); Article 14 reporting applies to them regardless. A new product, or a substantially modified one, placed on the market from that date needs:

• classification against Annexes III and IV (Articles 7 and 8) and the conformity assessment procedure that follows from it (Article 32);
• a check of each Annex I requirement against your cybersecurity risk assessment;
• a support period (Article 13(8));
• the Annex VII technical documentation, the EU declaration of conformity and the CE marking;
• a working Article 14 reporting process, which already applies.

Each guide below starts from one US framework or law, shows which evidence carries over and lists the CRA work that remains. Four general guides also apply to US companies: CRA product classification, CRA technical documentation, IEC 62443 to the CRA and CRA reporting requirements.

Working with Meroi Security

For each product, we deliver a scope and classification determination, a gap register and a sequenced remediation plan, and we help build the technical documentation and the reporting process. See our Cyber Resilience Act compliance services.