Yes — unambiguously. The CRA applies to any product with digital elements placed on the EU market, regardless of where the manufacturer, importer, or distributor is headquartered. A software company in Singapore, a hardware manufacturer in India, or a SaaS vendor in the United States that sells or distributes products to EU customers is fully subject to CRA obligations. Non-EU manufacturers must additionally appoint an EU Authorised Representative under Article 22 of the regulation.

CRA and GDPR are complementary frameworks. The CRA governs the security of digital products and their development lifecycle, while GDPR governs the processing of personal data. Where a product processes personal data — which many connected devices and software products do — both frameworks apply simultaneously. Vista InfoSec's integrated programmes map controls across both frameworks to eliminate duplication and build a single evidence base that satisfies both regulators.

The CRA establishes three penalty tiers. The most serious violations — including placing non-compliant products on the EU market — carry fines up to €15 million or 2.5% of global annual turnover, whichever is higher. Other CRA violations carry fines up to €10 million or 2% of global turnover. Providing incorrect information to authorities carries fines up to €5 million or 1% of turnover. Beyond financial penalties, market surveillance authorities can order mandatory product withdrawal from the entire EU market.

Under the CRA framework, "important" and "critical" product categories require third-party conformity assessment by a notified body. Default category products (the majority) may self-assess against harmonised standards. Product classification depends on the product's functionality, risk profile, and whether it is listed in Annex III or Annex IV of the regulation. Vista InfoSec's gap assessment includes product classification as a critical first step — misclassification is one of the most common and consequential errors organisations make at the outset of their CRA programme.

Timeline depends on your product category, current security posture, and organisational complexity. For default-category products with reasonable existing security controls, a structured CRA programme can achieve a defensible compliance posture in 12–16 weeks. For important or critical category products requiring notified body assessment, allow 18–24 weeks. Vista InfoSec's pre-built frameworks and documentation accelerators can reduce these timelines by up to 40% compared to building from scratch.

Under the CRA, the equivalent distinction is between manufacturers (who design and develop the product and carry the primary compliance burden), importers (who bring non-EU products into the EU market and carry secondary liability), and distributors (who make products available on the market and must verify manufacturer compliance). Each role carries distinct obligations under the regulation. Vista InfoSec's scoping assessment identifies your role in the supply chain and maps the precise obligations that apply.

The CRA does not provide blanket exemptions for startups or SMEs, but does include provisions to reduce administrative burden — including simplified documentation requirements for micro and small enterprises, and national authority guidance programmes. Core security requirements and vulnerability handling obligations apply equally to all organisation sizes. Vista InfoSec offers right-sized CRA programmes specifically designed for SMEs and growth-stage technology companies entering the EU market.