The Cyber Resilience Act for Private Equity

The Cyber Resilience Act for private equity: what PE-owned software and hardware companies must do now

Short answer: the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) makes cybersecurity a legal condition for selling software and connected hardware in the EU. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents within 24 hours, for every product already on the market. From 11 December 2027, new products need secure design, vulnerability handling, security updates for at least five years and a CE marking based on a conformity assessment. For investors, the CRA is a due diligence question before signing and a value-protection programme after closing.

Who is affected?

The CRA covers products with digital elements: software and hardware whose intended use includes a data connection to a device or network, plus the remote data processing the manufacturer builds for them (for example the cloud backend an app or device cannot work without). Obligations sit mainly with the manufacturer, the company that develops the product or has it developed and sells it under its own name. Importers and distributors have their own, lighter duties.

Some products are excluded because sector rules already cover them, among them medical and in-vitro diagnostic devices, motor vehicles, certified aviation products and marine equipment. Pure software-as-a-service without a product attached is generally a NIS2 topic rather than a CRA topic. But many SaaS companies also ship components that are products with digital elements, such as desktop or mobile apps, on-premises agents and connectors, SDKs or firmware. In a typical PE portfolio, the CRA hits software, hardware and IoT companies and more SaaS companies than expect it. In our due diligence work, targets often learn from us that they are affected.

The timeline

• 10 December 2024: the regulation entered into force.
• 11 June 2026: rules for the bodies that carry out third-party conformity assessments apply.
• 11 September 2026: reporting obligations apply, also to products placed on the market before 2027.
• 11 December 2027: all other requirements apply. Products already on the market before that date only fall under them if they are substantially modified; the reporting duty applies to them regardless.

What must be reported, and how fast

Manufacturers notify the national CSIRT designated as coordinator and ENISA through a single EU reporting platform:

• Actively exploited vulnerability: early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available.
• Severe incident affecting the product's security: early warning within 24 hours, a notification within 72 hours, and a final report within one month of the notification.

Users must also be informed so they can protect themselves. Few mid-sized companies can produce a qualified report within 24 hours on a weekend today; this is usually the first gap to close.

The core obligations from December 2027

• Secure by design and by default according to the essential requirements in Annex I, based on a documented cybersecurity risk assessment.
• Vulnerability handling: a coordinated vulnerability disclosure policy, a contact point for reports, a software bill of materials (SBOM) and security updates without delay.
• Support period of at least five years, or the expected use time if shorter, during which security updates are provided.
• Conformity assessment and CE marking with technical documentation. Most products can self-assess; important products (Annex III, for example identity and access management, password managers, VPNs, SIEM, operating systems, routers) need harmonised standards or a third party, and critical products (Annex IV) the strictest route.

Non-compliance with the essential requirements or the reporting and manufacturer obligations can cost up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Market surveillance authorities can also order products off the market, which is the bigger risk for a portfolio company's revenue.

What the CRA means in due diligence

Before signing, the question is not whether the target is "CRA compliant" (almost nobody is yet) but whether it can get there by December 2027, at what cost, and whether it can report today. We check:

• Product inventory and classification: which products and versions are sold in the EU, which are important or critical products, and who the manufacturer of record is.
• Reporting readiness: who decides within 24 hours that a vulnerability is actively exploited, and whether that has been rehearsed.
• Vulnerability handling: disclosure policy, PSIRT or equivalent, SBOMs, how fast fixes ship, and the open-source components behind them.
• Support commitments: whether a five-year update promise is technically and commercially realistic for each product line, including legacy versions.
• Secure development evidence: risk assessments, security testing and documentation that a conformity assessment will need.
• Remediation cost and timing: what it takes to close the gaps by December 2027, so it can go into the model, the purchase price or the 100-day plan.

Red flags are no owner for product security, no SBOM, no way to push security updates to installed products, important products without a plan for third-party assessment, and customer contracts that already promise more than the company can deliver.

What companies underestimate

The paperwork. The CRA expects a manufacturer to produce and maintain, per product:

• a documented cybersecurity risk assessment;
• technical documentation (Annex VII): design, development and production, the vulnerability handling process, applied standards and test reports;
• a software bill of materials covering at least the top-level dependencies;
• information and instructions for users (Annex II), including a contact point for vulnerabilities and the end of the support period;
• a coordinated vulnerability disclosure policy, and records of reports and notifications;
• the evidence of the conformity assessment, the EU declaration of conformity (Annex V) and the CE marking.

Technical documentation and the declaration of conformity must be kept for at least ten years after the product is placed on the market, or for the support period if that is longer.

The engineering. Paperwork alone does not make a product compliant. Products and development processes often need fundamental changes: SBOMs generated in every build, secure boot and signed updates, real multi-factor authentication instead of shared or default passwords, secure default configurations, and an update mechanism that reaches every installed product. These changes take quarters, not weeks, which is why December 2027 is closer than it looks.

A 90-day plan for portfolio companies

1. Weeks 1-2: list products and versions on the EU market, classify them, name an owner for CRA readiness.
2. Weeks 3-6: set up the 24-hour reporting path (decision rights, contacts, templates, an on-call rule) and run one tabletop exercise.
3. Weeks 5-10: publish a vulnerability disclosure policy, generate SBOMs in the build pipeline, define support periods per product.
4. Weeks 8-12: gap assessment against Annex I, decide the conformity assessment route, put the remediation budget into the plan.

Across a portfolio, the same steps repeat in every company. That is why they work well as a cohort: in an int[cube] CRA cohort, 5-25 products go through the same steps in parallel, each team on its own product, with shared templates and expert support.

How int[cube] helps

int[cube] works on the CRA at every stage of the investment:

• Before signing: our cyber and product due diligence shows whether and how a target is affected, often for the first time, and what closing the gaps will cost.
• After closing: gap analysis against the CRA and support with implementation, from reporting readiness to SBOMs and conformity assessment.
• Across the portfolio: CRA cohorts that take 5-25 products through the same steps in parallel, and broader product security programmes that build the development practices the CRA assumes.

Talk to int[cube] about the CRA in your portfolio.

This page summarises the regulation as published in the Official Journal (OJ L, 2024/2847, 20.11.2024). It is not legal advice.

‍

Further reading

• Cyber due diligence for M&A and private equity
• Cyber due diligence checklist for private equity deals
• Cybersecurity for private equity portfolios
• Light-touch cyber due diligence for deals you can't get inside

Frequently asked questions

When does the Cyber Resilience Act apply?

The CRA entered into force on 10 December 2024. Its reporting obligations apply since 11 September 2026, also to products already on the market. All other requirements, including secure design, vulnerability handling, security updates and CE marking, apply from 11 December 2027.

Does the CRA apply to SaaS?

The CRA covers products with digital elements, software and connected hardware, together with the remote data processing a product needs to work, such as its cloud backend. Pure software-as-a-service without a product attached is generally covered by NIS2 instead, but many SaaS companies also ship components that count as products, such as apps, agents, connectors or SDKs.

What must be reported within 24 hours?

Manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting the security of their product, to the national CSIRT designated as coordinator and ENISA through a single EU reporting platform. A notification follows within 72 hours and a final report later.

What documentation does the CRA require?

Per product: a cybersecurity risk assessment, technical documentation (Annex VII), a software bill of materials, information and instructions for users (Annex II), a coordinated vulnerability disclosure policy, the conformity assessment evidence and the EU declaration of conformity (Annex V). Technical documentation and the declaration must be kept for at least ten years or the support period, whichever is longer.

How long must security updates be provided?

For the support period, which must be at least five years, or the expected use time of the product if that is shorter.

What are the fines under the CRA?

Up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaching the essential cybersecurity requirements or the manufacturer and reporting obligations. Authorities can also order non-compliant products off the market.

How should investors treat the CRA in due diligence?

Check which products are sold in the EU and how they are classified, whether the target can report within 24 hours today, how it handles vulnerabilities and SBOMs, whether a five-year support period is realistic, and what closing the gaps by December 2027 will cost. The result belongs in the price, the closing conditions or the 100-day plan.