# Understanding the EU Cyber Resilience Act (CRA)

DevFeed: [Understanding the EU Cyber Resilience Act (CRA)](<https://devfeed.tech/articles/understanding-the-eu-cyber-resilience-act-cra-13754.md>)

Original publisher: [Read original article](<https://developer.espressif.com/blog/2026/03/esp32-cra-compliance/>)

Author: John Lee

Published: 2026-03-16T00:00:00Z

Content type: article

Language: en

Sources: [Blog on Developer Portal](<https://devfeed.tech/sources/blog-on-developer-portal.md>)

Topics: [cyber resilience act](<https://devfeed.tech/topics/cyber-resilience-act.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [ESP32](<https://devfeed.tech/topics/esp32.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Espressif](<https://devfeed.tech/topics/espressif.md>), [Software](<https://devfeed.tech/topics/software.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [cra-requirements](<https://devfeed.tech/tags/cra-requirements.md>), [cyber-resilience-act](<https://devfeed.tech/tags/cyber-resilience-act.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [digital-products](<https://devfeed.tech/tags/digital-products.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [esp-idf](<https://devfeed.tech/tags/esp-idf.md>), [esp32](<https://devfeed.tech/tags/esp32.md>), [espressif](<https://devfeed.tech/tags/espressif.md>), [eu](<https://devfeed.tech/tags/eu.md>), [iot](<https://devfeed.tech/tags/iot.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article explains how the EU Cyber Resilience Act applies to ESP32-based digital products, including connected devices, embedded systems, firmware, companion applications, and related cloud offerings. It outlines the CRA timeline, including vulnerability reporting obligations from September 2026 and core requirements from December 2027, and discusses compliance considerations for OEM manufacturers.

## Source excerpt

The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market. This blog outlines what the CRA means for ESP32-based products, the obligations for OEM manufacturers, and how Espressif will support customers in achieving compliance.