Scope & roles
App yes, browser no: the CRA attaches to where the software executes. Who the manufacturer is depends on the brand, not the contract.
Clarify product and rolesIs there a CRA exemption for the financial sector?
No. The Cyber Resilience Act is a horizontal act for products with digital elements. Art. 2(2) to (7) list the exemptions exhaustively: medical devices, motor vehicles, certified aviation products, marine equipment, identical spare parts, and products for national security and defence. The financial sector is not among them – there is no exemption for supervised entities, none for essential entities under NIS 2 and none for companies already audited under other frameworks. Whoever is not listed is covered.
For banks and insurers the decisive question is therefore the role: under Art. 3(13) the manufacturer is whoever develops or manufactures a product or has it designed, developed or manufactured and markets it under its own name or trademark – for payment or free of charge. The free banking app in the store, built by a service provider, makes the bank the manufacturer.
| System | CRA question | Classification under the Commission guidance |
|---|---|---|
| Mobile banking app | Is the app provided under the institution's own brand and under its responsibility? | Native app running on the device: a product with digital elements – plus the backend insofar as the app could not perform a function without it. |
| Insurance app (white label) | Who commissions development, who publishes, under whose brand? | Marketing under one's own brand suffices for the manufacturer role; the provider of the base is a supplier. |
| Online banking portal | Pure browser use, or remote data processing of an app? | As a stand-alone browser portal not a product – but the same platform is remote data processing of the app and is covered to that extent. |
| Loan calculator with backend | Is a stand-alone software component made available? | Only a locally executed client or a separately placed component is a product. |
| Purchased core software | Who is the manufacturer, what stays with the institution? | The vendor is the manufacturer; the institution steers under DORA and, where it is itself a manufacturer, owes due diligence and feedback duties for components (Art. 13(5) and (6)). |
Which CRA deadlines apply?
In force since 10 December 2024, reporting obligations since 11 September 2026 (Art. 14), all main obligations and CE marking from 11 December 2027.
| Date | What applies | Practical consequence |
|---|---|---|
| 10 December 2024 | CRA entered into force | Prepare role clarification, product inventory and development processes. |
| 11 September 2026 | Reporting obligations under Art. 14 CRA apply – also to legacy products (Art. 69(3)) | Report actively exploited vulnerabilities and severe incidents via the ENISA Single Reporting Platform: early warning within 24 hours, notification within 72 hours, final report after 14 days (vulnerability) or one month (incident). |
| 11 December 2027 | Full application of the main obligations | Essential requirements under Annex I, technical documentation, conformity assessment, EU declaration of conformity and CE marking. |
Two further dates are regularly misread: since 11 June 2026 the notification regime for conformity assessment bodies (Chapter IV) applies – no manufacturer obligation follows from it. By 11 December 2026 Member States are to ensure a sufficient number of notified bodies; in the English, French and Italian versions this is a best-efforts duty, only the German version phrases an obligation of result.
Status 21 October 2026: four findings that shape the planning
First: none of the 41 harmonised standards commissioned under standardisation request M/606 is cited in the Official Journal; the presumption of conformity under Art. 27(1) is therefore empty. Second: no conformity assessment body is notified for the CRA. Third: the delegated act under Art. 27(9) that would make a European certification scheme (EUCC) count is not adopted; the Commission announces it for the fourth quarter of 2026. Fourth: the timetable stands: the Digital Omnibus (Regulation (EU) 2026/1744) postponed the AI Act, not the CRA. Only the delivery deadlines of the standardisation bodies were moved by two months – and only in draft.
What does the CRA require in practice?
Security by design, vulnerability handling, a support period of at least five years, technical documentation and a reporting process for actively exploited vulnerabilities.
- security by design and secure default configurations (Annex I Part I, thirteen product properties)
- vulnerability handling over the entire support period: software bill of materials, remediation, testing, coordinated disclosure, reporting contact, secure update distribution (Annex I Part II)
- a support period reflecting the expected period of use, at least five years (Art. 13(8))
- technical documentation under Annex VII and the EU declaration of conformity; CE marking before placing on the market
- a reporting process for actively exploited vulnerabilities and severe incidents – since 11 September 2026 (Art. 14)
CRA and DORA: Does one count towards the other?
No. DORA regulates the financial entity as a supervised organisation and its ICT risk management. The CRA regulates the product and the economic operators along the product chain. A framework that obliges the organisation sets no product requirements and cannot relieve you of the CRA. A security-relevant incident in an app can therefore trigger both the DORA notification to the FMA and the CRA report via the ENISA platform – with two sets of clocks and two sets of addressees.
Keep the clocks apart
CRA: early warning 24 hours and notification 72 hours from awareness; final report 14 days after a fix is available (vulnerability) or one month after the 72-hour notification (incident). DORA (Delegated Regulation (EU) 2025/301): initial notification as soon as possible, no later than 4 hours after classification as major and 24 hours after detection; intermediate report within 72 hours of the initial notification; final report within one month of the last intermediate report. The reporting clock on the topic page calculates both regimes side by side.
The topic pages
Reporting & DORA
Since 11 September 2026: six deadlines, the ENISA platform in its initial build, CERT.at, fallback procedure – and the reporting clock for CRA and DORA.
Walk through the reporting processSBOM & suppliers
Software bill of materials, third-party components, feedback to suppliers, open-source steward – and why ISO 27001 saves work but no obligation.
Build the evidence chainConformity, standards & CE
Product classes with examples, modules A/B+C/H, zero of 41 standards, no notified body – and what replaces the presumption.
Determine the assessment routeSupport, updates & modifications
Five years is a floor. When an update is a substantial modification and how the support period becomes a liability boundary.
Plan the lifecycleCRA in Austria
Authorities, CERT.at, accompanying act, fine ranges, product liability without a draft and board liability – the local status.
Read the Austrian statusThe CRA dates in the context of regulatory reporting
Reporting obligations have applied since 11 September 2026, the remaining manufacturer obligations apply from 11 December 2027. Both dates sit – alongside SREP, DORA, NISG 2026 and the AI Act – in the Regulatory Reporting Roadmap 2026–2028; what links CRA reporting to supervisory reporting is shown by the data core.
What should be done now?
Five steps: product inventory, role clarification, reporting readiness, gap analysis against Annex I and a reasoned product classification.
- Product inventory: which apps, clients and components does the institution provide under its own brand – including legacy products in the store?
- Role clarification: manufacturer, importer, distributor, authorised representative, user – per product and legal entity, by the logo and by the contract.
- Establish reporting readiness: EU Login accounts, named representatives, CERT.at as coordinator, a rehearsed procedure – the duty has applied since 11 September 2026.
- Gap analysis against Annex I and build the evidence file under Annex VII point 5 instead of waiting for harmonised standards.
- Determine the product class with reasons: it decides whether a notified body is needed – of which there are none yet.
Frequently asked questions
Does the CRA affect a bank that does not sell software?
Yes, as soon as it makes a product with digital elements available under its own brand – typically the banking app in the app store. Payment is not required. For purchased core software the vendor is the manufacturer.
Does DORA compliance replace the CRA obligations?
No. DORA is organisational law, the CRA is product law. None of the CRA's linkage mechanisms offsets sectoral supervision; both reporting channels run in parallel.
Do the reporting obligations apply to an app that has been in the store for years?
Yes. Art. 69(3) CRA expressly extends the Art. 14 reporting obligations to products placed on the market before 11 December 2027. The other obligations apply to legacy products only after a substantial modification.
Was the CRA postponed like the AI Act?
No. The Digital Omnibus (Regulation (EU) 2026/1744) amends the AI Act, not the CRA. As of 21 October 2026 no proposal to postpone the CRA deadlines existed.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).