Skip to main content

EU Cyber Resilience Act (CRA) Compliance Statement

Brainboxes is actively monitoring and preparing for the requirements of the EU Cyber Resilience Act (Regulation 2024/2847), which applies to manufacturers of products with digital elements sold in the EEA. The Act entered into force in December 2024 and is being implemented in phases:

  • 11 September 2026: vulnerability reporting obligations take effect.
  • 11 December 2027: the remaining requirements apply for newly released or significantly changed products. Including but not limited to; risk assessments, essential product design requirements, vulnerability handling and conformity assessments.

Scope and Brainboxes Products​

We recognise that many of our customers are undertaking their own CRA readiness activities, and may need to understand how their component suppliers are preparing.

Brainboxes products with digital elements, fall within scope of the CRA. Which requirements apply to a given product depends on when it was placed on the market:

  • Products already on the market before 11 December 2027: as per EU guidance for manufacturers, unless significantly changed are required to comply with Article 14 of the CRA only. As part of our CRA compliance planning, Brainboxes are considering whether to optionally bring these existing products into line with the wider requirements that apply from 11 December 2027, and will provide updates here as those decisions are made.
  • Products placed on the market on or after 11 December 2027: will need to meet the CRA's full requirements. Our teams are working to ensure all new products planned for release after this date, and any planned for release in 2027 are fully compliant.

If you incorporate Brainboxes products as components into your own products, you may need those components to meet the full CRA requirements rather than Article 14 alone. This applies, for example, if you plan for your own product to be placed on the market on or after 11 December 2027, if you plan to significantly change the product on or after 11th December 2027, or if you optionally choose to bring your product into line with the full requirements despite already existing on the market. If any of these scenarios apply to you, please contact us so we can discuss further.

Our Approach to Exploited Vulnerability Reporting​

From September 2026, Brainboxes have implemented processes to meet our reporting obligations under Article 14 of the CRA should they be needed. If we become aware of an actively exploited vulnerability or a severe incident affecting one of our products, we will verify the report and then notify the relevant EU authority in three stages: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of a fix or mitigation becoming available.

We've built these processes into the support channels our customers already use, rather than asking anyone to learn a new contact route. If you believe you've found an exploited vulnerability or are affected by one, please treat it as a priority and contact our support team straight away at [email protected] or +44-151-220-2500. See our guide on how to report an actively exploited vulnerability for what to include.

For vulnerabilities that have not been exploited, such as those identified through independent security research, please use our dedicated security inbox at [email protected]. See our guide on how to report a vulnerability.

Ongoing Updates​

We are committed to keeping our customers informed as this work progresses, and plan to share updates at key milestones.

Contact​

Customers with specific queries about the EU Cyber Resilience Act and Brainboxes' compliance activities are welcome to contact us at [email protected].

Where we are unable to answer a specific query immediately, we will acknowledge receipt and respond fully once the relevant detail has been established through our ongoing work.

For broader regulatory information, see our Regulatory Compliance reference.

Last updated on