Cyber Resilience Act: what it is
The Cyber Resilience Act (CRA) is an EU law on the security of products that connect to a device or a network. It is Regulation (EU) 2024/2847. It covers hardware and software, and the maker must build in security, fix known holes and keep issuing updates for a stated time.12
The law applies to a product whose intended use includes a data connection to a device or a network. The connection can be physical, such as a cable or radio waves, or a software interface.1 That is why a plain radio and a Bluetooth radio land on different sides of it.
Cyber Resilience Act dates
The law is already in force, but most duties start in December 2027.12
| Date | What happens |
|---|---|
| December 10, 2024 | The CRA enters into force.12 |
| August 1, 2025 | The earlier radio rules for internet-connected radios start (the RED delegated act, see below).56 |
| June 11, 2026 | The chapter on conformity assessment bodies applies.1 |
| September 11, 2026 | Makers must report actively exploited vulnerabilities and severe incidents: early warning in 24 hours.1 |
| December 11, 2027 | All other CRA duties apply to products placed on the EU market from this date. The earlier radio cyber rules are repealed.17 |
| June 11, 2028 | Certificates issued under other EU product laws, such as the radio rules, can still be used under the CRA until this date.14 |
Dates can move. Check the current text on EUR-Lex.
Which walkie-talkies the Cyber Resilience Act covers
The law's test is a data connection. In practice, this means a radio with no way to exchange data with another device is outside, and a radio with a port, a Bluetooth link or a network link is inside. The Commission names Bluetooth as a physical data connection, and treats a USB port used only for charging as no data connection.34
| Radio | Covered by the CRA? | Why |
|---|---|---|
| Plain analog PMR446 radio, no data port | No | No data connection to a device or a network. It stays under the Radio Equipment Directive for radio rules.112 |
| Radio with a USB port used only for charging | No, in practice | Charging alone is not a data connection.4 |
| Radio with USB programming or firmware update | Yes | The USB port carries data, so the product has a data connection.14 |
| Bluetooth radio, or radio with a phone app | Yes | Bluetooth is a named physical data connection.3 |
| DMR business radio programmed by cable or PC software | Yes | The cable is a data connection, and the programming software is software with digital elements.14 |
| LTE (PoC) radio on Android or similar | Yes | It connects to a network. In practice, the maker's own app server counts as part of the product.1 |
What changes for walkie-talkie owners
In practice, a radio you already own needs nothing from you. A product placed on the market before December 11, 2027 does not need to meet the CRA unless it later gets a substantial modification, which means a big change to the product after sale.1
After December 11, 2027, new connected radios come with a stated support period. The maker must say clearly at purchase until when the radio gets security updates. The period is at least five years, or the expected use time if that is shorter.1 Each security update is kept available for at least ten years or the rest of the support period, whichever is longer.1
Where to read it on the box or in the paperwork:
- the CE mark on the radio or the box
- the EU declaration of conformity (DoC), as a paper copy or as a short version with a web address of the full text1
- the maker's name and contact details, and a contact point for reporting security problems1
- the end date of the support period, shown as month and year1
Security updates are switched on by default, with a choice to postpone them.1
What changes for shops and importers
A connected radio sold in the EU from December 11, 2027 carries the CE mark under the CRA. The maker prepares the technical documents, runs the conformity assessment and signs the EU declaration of conformity.1
An importer checks before selling:
- the conformity assessment was done
- the technical documents exist
- the CE mark and the EU declaration are there
- the user information, and the maker's name and address, are on the product1
The importer also puts its own name and address on the product and keeps the declaration for ten years or the support period, whichever is longer.1 A distributor checks the CE mark and that maker and importer did their part.1
A shop that sells a radio under its own brand name counts as the maker. In practice, this means the shop takes on the maker's duties.1
Fines reach EUR 15 million or 2.5% of yearly turnover for a breach of the main security duties, and EUR 10 million or 2% for importer and distributor duties.1
Internet radios since August 1, 2025: the RED rules
A narrower rule is already running. Since August 1, 2025, radio equipment that can communicate over the internet must protect networks, and must protect personal data if it handles any. That is the RED delegated act, Regulation (EU) 2022/30.56
In practice, an LTE (PoC) radio fits that wording and an analog PMR446 radio does not. The delegated act is repealed from December 11, 2027, and the CRA takes over for radios placed on the market from that date.7
UK version: the PSTI rules
The UK has its own law for connected products: the Product Security and Telecommunications Infrastructure (PSTI) Act, with Regulations that apply since April 29, 2024.89 It covers products sold to UK consumers and has three requirements:910
- No universal default passwords. A password must be unique per product or set by the user.
- A way to report security bugs. The maker publishes a contact point.
- A published update period. The maker states in plain English how long the product gets security updates, with an end date.
A manufacturer, importer or distributor must also supply a statement of compliance with the product.89
The law covers products that can connect to the internet, and products that can connect to a network in a narrower way. A radio with no wireless data link is not a connectable product in the law's sense, so a plain analog radio is out.811 In practice, an LTE (PoC) radio sold to UK consumers connects to the internet, so it is in.11
A Bluetooth radio depends on the law's test. The test says: the product can connect directly to two or more other products at the same time, and it can also connect directly to a product that reaches the internet.11 In plain words, a Bluetooth radio that links to your phone and to a headset at the same time fits that test. In practice, a radio that pairs with only one device at a time does not clearly fit it.11
Pairing PINs for Bluetooth do not count as passwords under the first requirement, but the bug-reporting contact and the update period still apply.9
Penalties reach 10 million pounds or 4% of worldwide revenue.10
Questions
Does the Cyber Resilience Act apply to a normal PMR446 walkie-talkie?
In practice, no. A plain analog PMR446 radio has no data connection to a device or a network, and the CRA covers products with one. The radio rules and CE marking under the Radio Equipment Directive still apply.112
Do I need to replace my Bluetooth walkie-talkie after December 2027?
No. A radio placed on the market before December 11, 2027 does not need to meet the CRA unless it later gets a substantial modification.1
When must a maker tell me how long my radio gets updates?
For radios placed on the market from December 11, 2027, the end date of the support period must be clear at purchase. The period is at least five years, or the expected use time if that is shorter.1
Sources
- Cyber Resilience Act · European Commission
- CRA implementation, frequently asked questions · European Commission
- Commission guidance on the Cyber Resilience Act · European Commission
- Product Security and Telecommunications Infrastructure Act 2022, Part 1 · legislation.gov.uk
Show all 12 sources
- PSTI Act 2022, section 5, meaning of connectable · legislation.gov.uk
