The short answer
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is a product law. It obliges manufacturers, importers and distributors of products with digital elements, meaning hardware and software that users receive and run themselves.
The European Commission’s guidelines of July 2026 confirm: a website that shows information to visitors is not such a product, and neither are web applications that are only used in the browser. It is only different if you sell software or connected devices yourself. Then the CRA concerns those products, not your website.
- Manufacturers of hardware and software that users receive and run themselves
- Vendors of commercial WordPress plugins, themes and Shopware extensions
- Importers and distributors of such products, for the products they sell
- Businesses that only run a website or an online store
- Websites themselves: they are not products within the meaning of the CRA (Recital 12)
- Web applications that are only used in the browser, and cloud services, to which the NIS2 Directive applies
If you only run a website or a store, the CRA does not oblige you. It applies to the vendors of your plugins and extensions, and you feel it through their updates.
The timeline
All deadlines are aimed at manufacturers. In Germany, the BSI (CERT-Bund), the Federal Office for Information Security, is the coordinating CSIRT.
- December 10, 2024
In force
Regulation (EU) 2024/2847 enters into force. Manufacturers have a transition period.
- applies since September 2026 September 11, 2026
Reporting obligations
Manufacturers report actively exploited vulnerabilities and severe security incidents through ENISA’s reporting platform, including for products that were already on the market before (Art. 14, Art. 69).
- December 11, 2027
Full application
CE marking for new products, handling of vulnerabilities and security updates over a support period, generally at least five years (Art. 13).
Reporting deadlines for manufacturers for actively exploited vulnerabilities (Art. 14)
- 24 h
Early warning after becoming aware of an actively exploited vulnerability
- 72 h
Notification with details on the vulnerability, its exploitation and corrective measures
- 14 days
Final report after a corrective measure is available
What plugin and extension vendors have to do now
What matters is whether software is made available in the course of a commercial activity. A price for the software is enough for that, but other forms of monetization count as well (Recital 15). The European Commission’s guidelines of July 27, 2026 (C(2026) 5252, not binding) explain this with general examples. Applied to plugins, this means:
| Case | Under the CRA? | Why |
|---|---|---|
| Paid plugin or license with access to updates | Yes | A price is charged for the software. The vendor is the manufacturer. |
| Free version plus paid pro version | Yes | The pro version is a separate, monetized product. If the free version is under an open source license and a company maintains it, the light obligations of an open source steward can apply to it. |
| Free plugin, updates only for a donation or license | Yes | If access to updates or security fixes is tied to payments, that counts as a price. |
| Free plugin maintained on a sustained basis by a foundation or company | Light rules | Light obligations as an open source steward: cybersecurity policy, cooperation with authorities, reporting (Art. 24). |
| Free plugin with optional, separately paid support | No | The software can be used freely, and the support is only an additional offer. |
| Purely non-commercial open source software | No | Open source software that is not monetized is not considered placed on the market (Recital 18). |
What manufacturers have to provide from December 11, 2027, among other things
- 01
Fix vulnerabilities without delay
Security updates separately from feature updates where possible and, as a rule, free of charge.
- 02
Name a contact point
An address through which users and researchers can report vulnerabilities.
- 03
State the support period
Clearly visible at the time of purchase: until when the product receives security updates, at least by month and year.
Sources: Regulation (EU) 2024/2847, Art. 13, Art. 24 and Annex I; European Commission guidelines C(2026) 5252.
What changes for you indirectly
Legally, nothing changes for you. In practice, you feel the CRA through your plugins and extensions:
More and faster security updates
Manufacturers have to close vulnerabilities without delay and report exploited ones. Patches can be expected to come out faster and more often.
Some vendors pull out
Individual small vendors can be expected to shy away from the effort and stop offering their products in the EU or discontinue them.
Support periods become visible
From December 2027, for new products, you learn at the time of purchase until when they receive security updates.
A patch only protects you once it has reached your website. But more updates also mean more chances for one of them to break something. So: test first, then apply promptly.
What you can do
- 01
An overview of your plugins and extensions
Which vendor, is it still maintained, is there a contact point for security reports? Whatever is not needed should be deleted.
- 02
Test updates and apply them promptly
Ideally on a copy of the website, then live without a long wait.
- 03
Backups
A current, independent backup that can actually be restored.
Where NIS2 and the GDPR actually concern you
NIS2
Applies to companies in certain sectors, generally with 50 or more employees or with more than €10 million in annual turnover and annual balance sheet total (BSI).
GDPR, Art. 32
Requires security that takes the state of the art into account, regardless of size, including for a website with a contact form or a store.
More on this in the guides Updates are mandatory: what the GDPR requires and NIS2 for small businesses.
Where the Doppelgänger helps
The CRA asks nothing of you, and the Doppelgänger is not a compliance product. It helps with the practical effect: getting security updates, which come more often, onto your website tested and quickly.
A copy first
I apply every update to an exact copy of your website first and test it.
Then live promptly
After the test, security updates usually go live within 24 to 48 hours.
Plugin inventory every night
Automated checks record all plugins and extensions and match them against known vulnerabilities.
Encrypted backup
An independent, encrypted backup on servers in Germany every night.
More on this on the pages for WordPress and Shopware.
Note: this guide is not legal advice. Whether you have obligations under the CRA for a particular product is something to clarify with a lawyer if in doubt.
Quick answers.
Do I have to do anything about the CRA as a store owner?
Not as the owner of a website or an online store. The CRA obliges manufacturers, importers and distributors of products with digital elements, not the users of software. According to the regulation and the European Commission's guidelines, websites are not such products. It is different if you sell software or connected devices yourself: then you may have obligations as a manufacturer or distributor for those products.
Does the CRA apply to WordPress itself?
WordPress is free open source software. Under the CRA, open source software that is not monetized is not considered placed on the market, and there is a light special regime for organizations that maintain such software on a sustained basis, as open source stewards. Paid plugins, themes and editions, on the other hand, are products within the meaning of the CRA. In none of these cases do you as a user have obligations under the CRA.
What about stores that sell connected devices?
If you sell connected devices or software, you are a distributor of those products within the meaning of the CRA, and if you import them yourself from a country outside the EU, you are an importer. From December 11, 2027, a distributor checks, among other things, whether the product carries the CE marking and whether the manufacturer supplies the required information. This concerns the products you sell, not your website or your store software.
Does the Doppelgänger make me CRA compliant?
No, and it does not need to: as the owner of a website or a store, you are not obliged by the CRA. The Doppelgänger helps you with the indirect effect, that is, with applying the expected more frequent security updates for your plugins and extensions tested and quickly.
What changes for me in concrete terms?
Legally, nothing. In practice, manufacturers can be expected to close vulnerabilities faster and security updates to come out more often. From December 2027, manufacturers also have to state at the time of purchase, for new products, until when a product receives security updates. It makes sense to know which plugins and extensions you use, and to apply updates promptly but tested.