Guides: Cyber Resilience Act and DORA, for companies outside the EU
Practical guides for US, UK and Asian software, device and SaaS companies that sell into the EU. Each one cites the articles it relies on and says what is still uncertain.
Does the CRA apply to my company? A scope checklist
The Cyber Resilience Act (Regulation (EU) 2024/2847) applies to products with digital elements, meaning software or hardware and their remote data processing, that connect to a device or network and are made available on the EU market in the course of a commercial activity, paid or free. Where the manufacturer is based doesn't matter. Pure SaaS is generally out; the cloud backend a product needs is in. Medical devices, vehicles, certified aviation products, marine equipment and defense products are excluded.
Updated November 3, 2026 · Read the guide
CRA 24-hour vulnerability reporting for non-EU manufacturers
Since September 11, 2026, Article 14 of the Cyber Resilience Act requires every manufacturer of a product with digital elements sold in the EU, wherever it is based, to report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform: an early warning within 24 hours, a notification within 72 hours, then a final report. A manufacturer with no EU establishment reports to the CSIRT picked by Article 14(7): authorised representative first, then importer, distributor, and where most users are.
Updated November 3, 2026 · Read the guide
Answering a DORA vendor questionnaire as a US SaaS company
DORA (Regulation (EU) 2022/2554) has applied since January 17, 2025 to EU financial entities, not to their vendors. But Articles 28 to 30 make your client assess you, record your contract in a register of information, plan its exit, and put minimum clauses in your contract. The questionnaire is how it checks. Statements rarely close it: dated evidence does, such as a timed restore test, a real export of one client's data and a subcontractor register.
Updated November 3, 2026 · Read the guide
Frequently asked questions
Are these guides legal advice?
No. They are written by a DevOps engineer from the official texts and cite their sources. For legal interpretation, talk to counsel.