--- title: "How to read the Cyber Resilience Act request of \"effective and regular tests" description: "Cyber Resilience Act requirements: what testing must prove. The CRA asks for effective and regular security tests but sets no method or frequency. What that means for manufacturers, and the evidence you will need." image: https://blog.unguess.io/hubfs/Canva%20images/Canva%20Design%20DAHV7yf54O8.png --- [![Vai alla homepage di UNGUESS](https://blog.unguess.io/hubfs/Imported%20images/unguess-logo.svg)](https://unguess.io/it) - PRODUCTS BY INDUSTRY - [Retail & Ecommerce](https://unguess.io/services/industry/retail-ecommerce/) - [Fast-Moving Consumer Goods](https://unguess.io/services/industry/fast-moving-consumer-goods/) - [Banking, Insurance & Financial Services](https://unguess.io/services/industry/banking-insurance-financial-services/) - [Travel & Hospitality](https://unguess.io/services/industry/travel-hospitality/) - [Utilities](https://unguess.io/services/industry/utilities/) - [Healthcare](https://unguess.io/services/industry/healthcare/) - [Media & Entertainment](https://unguess.io/services/industry/media-entertainment/) - [Automotive](https://unguess.io/services/industry/automotive/) - PRODUCTS BY USE CASE - [Ai Training](https://unguess.io/services/ai-training-testing/) - [User Experience](https://unguess.io/services/use-case/user-experience/) - [Software Quality](https://unguess.io/services/use-case/software-quality/) - [Cyber Security](https://unguess.io/services/use-case/cyber-security/) - [Accessibility](https://unguess.io/services/accessibility/) - [HOW IT WORKS](https://unguess.io/how-it-works/) - [OUR CROWD](https://unguess.io/our-crowd/) - COMPANY - [About us](https://unguess.io/about-us) - [Life at UNGUESS](https://unguess.io/life-at-unguess/) - [Partners](https://unguess.io/unguess-partners/) - [SHOWCASES](https://unguess.io/showcases/) - [Case Study](https://unguess.io/showcases/all-showcases/?jsf=jet-engine:shocase-listing-grid&tax=resource-category:76/#readmore) - [Unguess Challenges](https://unguess.io/showcases/all-showcases/?jsf=jet-engine:shocase-listing-grid&tax=resource-category:74/#readmore) - [White Paper](https://unguess.io/showcases/all-showcases/?jsf=jet-engine:shocase-listing-grid&tax=resource-category:75/#readmore) - [BLOG](https://blog.unguess.io) - - - - - [PRODUCTS](https://unguess.io/services/) - BY INDUSTRY - [Retail & Ecommerce](https://unguess.io/services/industry/retail-ecommerce/) - [Fast-Moving Consumer Goods](https://unguess.io/services/industry/fast-moving-consumer-goods/) - [Banking, Insurance & Financial Services](https://unguess.io/services/industry/banking-insurance-financial-services/) - [Travel & Hospitality](https://unguess.io/services/industry/travel-hospitality/) - [Utilities](https://unguess.io/services/industry/utilities/) - [Healthcare](https://unguess.io/services/industry/healthcare/) - [Media & Entertainment](https://unguess.io/services/industry/media-entertainment/) - [Automotive](https://unguess.io/services/industry/automotive/) - BY USE CASE - [Ai Training](https://unguess.io/services/ai-training-testing/) - [User Experience](https://unguess.io/services/use-case/user-experience/) - [Software Quality](https://unguess.io/services/use-case/software-quality/) - [Cyber Security](https://unguess.io/services/use-case/cyber-security/) - [Accessibility](https://unguess.io/services/accessibility/) - [VIEW ALL PRODUCTS](https://unguess.io/services/) - [HOW IT WORKS](https://unguess.io/how-it-works/) - [OUR CROWD](https://unguess.io/our-crowd/) - COMPANY - [About us](https://unguess.io/about-us/) - [Life at UNGUESS](https://unguess.io/life-at-unguess/) - [Partners](https://unguess.io/partners/) - [SHOWCASES](https://unguess.io/showcases/) - [Case Study](https://unguess.io/showcases/case-study/) - [Unguess Challenges](https://unguess.io/showcases/unguess-challenges/) - [White Paper](https://unguess.io/showcases/white-paper/) - [Webinar](https://unguess.io/showcases/webinar/) - [BLOG](https://blog.unguess.io) - - - - [CONTACT US](https://unguess.io/it/inizia-ora/) [SIGN UP](https://app.unguess.io/) Cybersecurity # How to read the Cyber Resilience Act request of "effective and regular tests Cyber Resilience Act requirements: what testing must prove. The CRA asks for effective and regular security tests but sets no method or frequency. What that means for manufacturers, and the evidence you will need. [Luca Manara](https://blog.unguess.io/author/luca-manara) Sep 22, 2026 --- ## **Key takeaways** - The **Cyber Resilience Act requires "effective and regular tests and reviews"** of product security (Annex I, Part II), with no set method, frequency or template. - Reporting of exploited vulnerabilities and severe incidents has applied since September 11, 2026, including for products already on the market. **Full requirements apply from December 11, 2027.** - In practice, **manufacturers must test, fix** what they find and document both (Annex VII). - Testing cadence should follow the product's risk and rate of change (Article 13), not a fixed calendar. - A testing record built continuously from now is easier to defend than one reconstructed later.   Buried in the Cyber Resilience Act is a sentence that will shape engineering budgets for years, and almost nobody outside compliance teams has read it. Annex I, Part II, point 3 requires manufacturers to apply "effective and regular tests and reviews" of the security of any product with digital elements. That is the entire instruction. No method specified. No frequency defined. No template provided. Manufacturers have to decide what that means for their own product, and be able to defend the decision. ## What the Cyber Resilience Act requires on security testing The **Cyber Resilience Act** (Regulation (EU) 2024/2847) is the EU regulation that sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the European market, across their whole lifecycle. On testing, its core requirement is a single line in Annex I: manufacturers must apply effective and regular tests and reviews of their product's security, choose how to do it, and be able to justify that choice. What the regulation does not say matters as much as what it does. There is no mandated test type, no minimum number of tests per year and no required report format. The burden of defining "effective" and "regular" sits entirely with the manufacturer. ## Cyber Resilience Act timeline: reporting is already live The CRA has been in force since December 2024, but its obligations arrive in phases. The first hard deadline has now passed: since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform, on a strict clock. An early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of a fix being available for an exploited vulnerability, or within one month for a severe incident. The full set of essential cybersecurity requirements, including the testing duty above, applies from December 11, 2027. One detail catches manufacturers off guard: these reporting obligations reach backward. Products already on the market, including ones that have not been touched or modified since, can still fall under the reporting duty. "We'll deal with this when we ship something new" is not actually an option for a lot of companies. On July 27, 2026, the European Commission published its first major guidance on applying the CRA in practice. It runs to roughly 80 pages, was built from a public consultation, and is aimed squarely at the companies finding the regulation hardest to interpret. It is nonbinding, but it is the clearest signal yet of how the rule will actually be enforced. One line from the Commission's own communication accompanying that guidance is worth sitting with. It explicitly cites recent developments in frontier AI models with cybersecurity capabilities as a reason the CRA's swift and correct implementation now matters more, not less. The regulator that wrote this rule is telling you, directly, that the AI accelerated vulnerability landscape is part of why the timeline matters. | Date | What applies | | --- | --- | | **December 10, 2024** | CRA enters into force | | **June 11, 2026** | Obligations for conformity assessment bodies | | **July 27, 2026** | First Commission guidance published | | **September 11, 2026** | Vulnerability and incident reporting to ENISA | | **December 11, 2027** | Full application, including essential requirements and testing | ## What "effective and regular" testing means in practice Read together with two other CRA provisions, the requirement that products ship without known exploitable vulnerabilities (Annex I, Part I) and the requirement that technical documentation include reports of the tests used to verify security (Annex VII), the testing duty adds up to something specific: manufacturers must test, act on what they find, and keep evidence of having done so. That last part is where most existing practice quietly falls short. A handful of habits get harder to defend once an auditor is asking about them directly: - A **findings** **list** with no assessment of which issues are actually exploitable - A **test report** that does not record what was tested, and what could not be - A **"fixed" status** with no verification that the fix actually held - A **single prerelease test** that never gets repeated after the product changes meaningfully None of these are unusual. They are just not going to survive a conversation with a market surveillance authority. ## How often should you test under the Cyber Resilience Act? The CRA does not set a testing interval, and that is deliberate rather than an oversight. Article 13 already requires manufacturers to assess the cybersecurity risk of their product and factor that into how it is designed, built and maintained. The natural reading is that testing cadence should follow the same logic: driven by the product's risk and how fast it changes, not by a fixed calendar date that has nothing to do with either. In practice, testing stops being a prerelease checkbox and becomes something triggered by the events that actually change your risk: - a change to authentication or authorization - a new or materially changed API endpoint - a new third party or model provider integration - a security update that touches an exposed part of the product - evidence that a component you rely on is being actively exploited somewhere else There is no universal answer to "how often." There has to be a defensible answer to "why this cadence, for this product." ## Building CRA compliance evidence before December 2027 Put plainly: you can build a testing record incrementally, starting now, while the full deadline is still more than a year away, or you can try to reconstruct one under pressure after a regulator, or a customer's procurement team, has already asked for it. This happens to be exactly the record that [continuous, human validated testing](https://security.unguess.io/bug-bounty) produces as a byproduct, not as a separate compliance exercise. When every finding is confirmed exploitable before it reaches you, remediation gets retested before it is marked closed, and everything that was attempted and *didn't* succeed gets recorded alongside what did, you end up with the artifact Annex VII is actually asking for: a documented account of what was tested, what was found, and what was verified fixed. Produced as you went, not reconstructed after the fact. That is the same principle behind how [UNGUESS Security](https://security.unguess.io/) works.   If needed, its network of European ethical hackers reports on every attempted exploit, not just the successful ones, and the model charges only for confirmed, validated findings rather than for activity. It turns out the discipline that makes a bug bounty program cost efficient is the same discipline a regulator wants to see documented. The companies that build this habit now reach December 2027 with a testing record already in place. The ones that don't will be assembling one retroactively, under a deadline they don't control.   [See what continuous, validated testing evidence actually looks like](https://security.unguess.io/)   ## Frequently Asked Questions ### What is the Cyber Resilience Act? The Cyber Resilience Act (Regulation (EU) 2024/2847) is an EU regulation that sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the European Union. It covers the whole product lifecycle, from design to vulnerability handling after release, and applies to manufacturers, importers and distributors. It entered into force in December 2024. ### When does the Cyber Resilience Act apply? The CRA applies in phases. Obligations for conformity assessment bodies started on June 11, 2026. Reporting of actively exploited vulnerabilities and severe incidents to ENISA has applied since September 11, 2026. The full set of essential cybersecurity requirements, including regular security testing, applies from December 11, 2027. ### What security testing does the Cyber Resilience Act require? Annex I, Part II, point 3 of the CRA requires manufacturers to apply effective and regular tests and reviews of their product's security. The regulation does not prescribe a method, a frequency or a format. Combined with the ban on shipping products with known exploitable vulnerabilities and the Annex VII documentation duty, it means manufacturers must test, fix what they find, and keep reports of the tests they ran. ### How often do you need to test a product under the CRA? The CRA sets no fixed testing interval. Because Article 13 ties the manufacturer's obligations to a cybersecurity risk assessment of the product, the defensible approach is risk driven: test when something changes the risk, such as a change to authentication, a new API endpoint, a new third party integration, or active exploitation of a component the product depends on. The manufacturer must be able to explain why the chosen cadence fits the product. ### What testing evidence will an auditor ask for under the CRA? Annex VII requires technical documentation to include reports of the tests carried out to verify that the product meets the essential requirements. In practice that means a record of what was tested and what was not, which findings were confirmed exploitable, and proof that each fix was retested. A list of scanner findings without that context is unlikely to satisfy a market surveillance authority. ### Do CRA reporting obligations apply to products already on the market? Yes. The reporting duty that started on September 11, 2026 also covers products placed on the market before the CRA applies in full, including products that have not been modified since. Manufacturers cannot postpone compliance until their next release. ### The testing record starts now The Cyber Resilience Act does not tell you how to test. It tells you that you will have to prove you did, and that the proof has to hold up. Every month of [continuous testing](https://security.unguess.io/) between now and December 2027 is a month of evidence you will not have to rebuild later. [Cybersecurity](https://blog.unguess.io/tag/cybersecurity) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.unguess.io%2Fcyber-resilience-act-testing-requirements) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fblog.unguess.io%2Fcyber-resilience-act-testing-requirements&text=How+to+read+the+Cyber+Resilience+Act+request+of+%26quot%3Beffective+and+regular+tests) [Share via Email](mailto:?subject=How+to+read+the+Cyber+Resilience+Act+request+of+%26quot%3Beffective+and+regular+tests&body=https%3A%2F%2Fblog.unguess.io%2Fcyber-resilience-act-testing-requirements) [Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.unguess.io%2Fcyber-resilience-act-testing-requirements&title=How+to+read+the+Cyber+Resilience+Act+request+of+%26quot%3Beffective+and+regular+tests&summary=Cyber+Resilience+Act+requirements%3A+what+testing+must+prove.+The+CRA+asks+for+effective+and+regular+security+tests+but+sets+no+method+or+frequency.+What+that+means+for+manufacturers%2C+and+the+evidence+you+will+need.) ## Similar posts Cybersecurity ### [AI Bug Bounty: why human hackers still find what AI misses](https://blog.unguess.io/ai-bug-bounty-human-researchers?hsLang=en) We asked the UNGUESS Security community how they use AI: 90% use it daily, almost none for vulnerability hypotheses. What that means for bug bounty. Luca Manara Aug 25, 2026 Software Development & Testing ### [How to create an effective regression testing suite](https://blog.unguess.io/how-to-create-an-effective-regression-testing-suite?hsLang=en) A regression testing suite is essential to ensure that your software works correctly after each change. What characteristics should it have and how... Angela Meduri Jan 31, 2025 Cybersecurity ### [How to make safe Payment Testing](https://blog.unguess.io/how-to-make-safe-payment-testing?hsLang=en) Through Payment Testing, organizations check a payment gateway's security and performance, while making sure the process offers a seamless UX. Newsroom Jun 30, 2022 UX & UI ### [UX Research: how to obtain quality results with crowdtesting](https://blog.unguess.io/ux-research-how-to-obtain-quality-results-with-crowdtesting?hsLang=en) How and why to effectively carry out UX research with a useful testing methodology to analyse apps and software before release to the public. Luca Manara Mar 31, 2022 ![unguess-logo-1](https://blog.unguess.io/hubfs/unguess-logo-1.svg) **© 2023 UNGUESS S.r.l.** UNGUESS is a registered trademark of UNGUESS S.r.l.   - [![U2Y - Verified Carbon Footprint](https://blog.unguess.io/hs-fs/hubfs/U2Y%20-%20Verified%20Carbon%20Footprint.png?width=50&height=50&name=U2Y%20-%20Verified%20Carbon%20Footprint.png)](https://app.u2y.io/brands/314) - [![UNGUESS is a leader in Crowd Testing Tools on G2](https://images.g2crowd.com/uploads/report_medal/image/1004327/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in Test Management on G2](https://images.g2crowd.com/uploads/report_medal/image/1004327/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in Crowd Testing Tools on G2](https://images.g2crowd.com/uploads/report_medal/image/1004379/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in Europe Test Management on G2](https://images.g2crowd.com/uploads/report_medal/image/1004391/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in EMEA Test Management on G2](https://images.g2crowd.com/uploads/report_medal/image/1004447/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) #### SERVICES - [AI Training](https://unguess.io/services/ai-training-testing/) - [User Experience](https://unguess.io/services/use-case/user-experience/) - [Software Quality](https://unguess.io/services/use-case/software-quality/) - [Cyber Security](https://unguess.io/services/use-case/cyber-security/) - [Accessibility](https://unguess.io/services/accessibility/) #### SHOWCASE - [Blog](https://blog.unguess.io) - [Our Crowd](https://unguess.io/our-crowd/) - [Tryber.me](https://tryber.me/) - [Integrations](https://unguess.io/integrations/) - [Partners](https://unguess.io/partners/) #### COMPANY [Work with us](https://unguess.io/life-at-unguess/#job-positions) [Get in touch](https://unguess.io/get-started/) **General inquires:** [info@unguess.io](mailto:info@unguess.io)   [Privacy Policy](https://unguess.io/privacy-policy/)  | [ESG Policy](https://unguess.io/esg-policy/)  | [Personal Data Processing Notice: Customers and Suppliers](https://unguess.io/personal-data-processing-notice-customers-and-suppliers/) | [Model 231](https://unguess.io/model-231/) | [Ethical Code](https://unguess.io/ethical-code/) | [Cookies Settings](https://www.iubenda.com/privacy-policy/833252/full-legal)  |  [Terms & Conditions](https://unguess.io/terms-and-conditions/) UNGUESS S.r.l. – VAT 01603290196   © 2022 Kalungi, Inc. - All Rights Reserved. [Powered by Atlas - a B2B SaaS HubSpot theme](https://www.kalungi.com/atlas-hubspot-theme-for-b2b-saas-software)