Cyber Resilience Act: what applies to software from SMEs in Switzerland and Liechtenstein?

The Cyber Resilience Act, or CRA, is Regulation (EU) 2024/2847. It covers products with digital elements that are offered on the EU market and connect to a device or network. That means software and hardware, including any remote data processing the manufacturer has built for the product to work.

The CRA distinguishes three roles. The manufacturer develops the product, or has it developed, and sells it under its own name. It carries most of the obligations. The importer brings a product from a manufacturer outside the EU onto the EU market, and the distributor resells it. Both must check that the manufacturer has met its obligations, for example that the CE marking is present.

Typical examples from everyday SME business:

Yes, as soon as you sell into the EU. The CRA is tied to the EU market, not to where the manufacturer is based. A Swiss or Liechtenstein SME that supplies software or devices to customers in the EU must meet the obligations of a manufacturer. If you sell only in Switzerland and Liechtenstein, you are not directly affected today. The EU AI Act follows the same market location principle for AI whose output is used in the EU. Read more in our guide "EU AI Act: what applies to SMEs in Switzerland and Liechtenstein?".

It depends on how the software reaches its users. The European Commission clarified this in its guidance of 27 July 2026.

Software that is installed and runs on the user's side is a product under the CRA. This applies to apps and desktop programs and is likely to apply to software installed on the customer's own server as well. According to the guidance, supplying source code to a single customer also counts as placing a product on the market.

A web application that users access exclusively through a browser, on the other hand, is not a product under the CRA. It is only covered if a product needs it to function, for example a portal that a connected device logs into or is controlled through. For pure cloud services, the EU's NIS2 Directive may be relevant instead of the CRA.

Since 11 September 2026, manufacturers must report two types of events: actively exploited vulnerabilities in their product and severe security incidents affecting the product. Actively exploited means there is reliable evidence that an attacker is already using the flaw.

The obligation also covers products sold before December 2027. Reports are submitted through ENISA's Single Reporting Platform, which has been operational since 11 September 2026. Each report goes to the competent national authority, a so-called CSIRT, and to ENISA at the same time. In addition, you inform affected users about the issue and possible countermeasures.

The deadlines start from the moment you become aware:

From 11 December 2027, manufacturers may only place products on the EU market that meet the CRA's essential requirements. Products placed on the market before that date only need to be brought into line after a substantial modification.

For products not classified as important or critical, a self-assessment of conformity is sufficient. Important and critical products, such as password managers, VPN software, operating systems, routers or firewalls, face stricter procedures, in some cases involving an external conformity assessment body. In practice, the obligations are:

If you have a product developed and sell it into the EU under your own name, you are usually the manufacturer. The obligations stay with you, even if a service provider writes the code. Your supplier must, however, provide what you need to meet them.

Plan for updates over the entire lifetime. As a guideline: with project costs of CHF 50,000 and maintenance costs of 15 to 20 percent per year, five years of support add up to CHF 37,500 to 50,000. Read more in our guide "Software maintenance costs: what do maintenance and operations cost per year?".

Clarify in the contract:

EU member states set the fines, and the CRA sets the upper limits. Breaching the essential requirements or the manufacturer and reporting obligations can cost up to EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher. For other obligations, the limit is EUR 10 million or 2 percent, and for incorrect or incomplete information given to authorities, EUR 5 million or 1 percent.

Regardless of fines, authorities can require a product to be corrected, withdrawn from the market or recalled.

Work through these questions in order. For the legal assessment of your specific product, consult a specialist body or a lawyer.