CRA Compliance for Defense and Dual-Use Manufacturers

Reporting obligations for actively exploited vulnerabilities and severe incidents took effect on September 11, 2026. Full enforcement follows on December 11, 2027, with fines of up to €15 million or 2.5% of global annual turnover.

This white paper examines where CRA exposure is highest in the defense and dual-use sector, why legacy products already on the market face immediate obligations, and how manufacturers can build an executable CRA readiness program before the deadlines arrive.

What's inside:

• Why the defense exemption only applies to products developed exclusively for national security purposes — and why many dual-use variants fall outside it

• How legacy products already on the EU market are exposed to CRA reporting obligations starting September 2026

• What CRA requires in engineering terms: security by design, SBOM and dependency visibility, structured vulnerability handling, and lifecycle support

• Why UK, US, and Canadian OEMs face specific European market access risk — and how to address it without building a large EU compliance function from scratch

• A 90-day action plan to assess exposure, recover control of legacy baselines, and start building defensible evidence across product lines