The Cyber Resilience Act (CRA) is an EU regulation that establishes mandatory cybersecurity requirements for products with digital elements sold within the European Union. For manufacturers, this means they are legally obligated to ensure products are secure throughout their entire lifecycle, from design to end-of-life. Key obligations for manufacturers include conducting cybersecurity risk assessments, implementing 'security-by-design' and 'security-by-default' principles, and ensuring products are delivered without known exploitable vulnerabilities. They must also manage vulnerabilities effectively after a product is on the market, provide security updates for a defined support period, and create a Software Bill of Materials (SBOM). Furthermore, manufacturers are required to report actively exploited vulnerabilities and severe security incidents to authorities like ENISA within a strict 24-hour timeframe for an initial warning.