The EU’s Cyber Resilience Act and the Cost of Being Unprepared
You may have heard about the EU’s Cyber Resilience Act (CRA), with reporting obligations taking effect on 11 September 2026, earlier this month as we write. But what does it really mean for investors and M&A?
Fines run to €15 million or 2.5% of global turnover
Don't let the CRA become the next GDPR moment for technology M&A!
Anyone planning an EU exit over the next year and beyond needs to consider the company’s current responsibilities and the work a buyer would inherit. Otherwise, during diligence, the buyer may ask a question management cannot answer: what will it cost to bring the products in line with the CRA?
This is how the CRA could become the next GDPR moment for technology M&A. Fines run to €15 million or 2.5% of global turnover, but that’s not the point. A regulatory obligation gives buyers another area to investigate, and sellers who cannot explain their exposure leave room for assumptions about cost, delay and liability. Those assumptions will feed directly into negotiations.
A seller who has already assessed the work and budgeted for it has a firmer basis for defending the forecast.
What the Cyber Resilience Act Covers
The CRA covers hardware and software products with digital elements made available on the EU market. Establishing which products are covered, and the company’s role in supplying them, comes first.
Two dates matter. Reporting obligations for actively exploited vulnerabilities and severe incidents affecting product security began on 11 September 2026. The fines apply from 11 December 2027, however, treating the whole program as something to deal with next year would overlook obligations already in place.
Fit into the Organization
Once the company has established its exposure, the assessment needs to reach the implementation phase. A product may need security improvements, better documentation or more developed vulnerability-handling processes.
CRA readiness requires people to own those processes and carry them out throughout the product’s lifecycle. An assessment can identify the gaps. Management still needs to assign responsibilities, give teams the capacity to do the work and check that the processes operate in practice.
Take a company whose forecast assumes a new product launch, several enterprise features and improving EBITDA margins. If the same engineering team must also complete unbudgeted CRA work, management needs to explain how it will deliver all of that.
Hiring affects the margin forecast. Moving developers affects the roadmap. Deferring the work leaves the buyer with the bill.
Four Steps Before Going to Market
Check what is already in place. Review how the company identifies and handles vulnerabilities, makes reporting decisions and maintains security documentation. Establish whether named people own these responsibilities and whether the processes are being followed.
Establish which products are in scope. Document the reasoning, the company’s role and any questions that need legal advice. Connect the assessment to the products and revenue streams the buyer is acquiring.
Cost the remaining work. Assign owners, estimate the effort and set delivery dates. Check whether the engineering plan and financial forecast allow for the work alongside existing customer commitments and product development.
Prepare the evidence for diligence. Give advisers a clear account of the assessment, the gaps and the plan. Management should be able to explain what is complete, what remains open and what a buyer would need to fund after completion.
There will almost always be work outstanding when the business goes to market. The problem is a buyer discovering it first. A seller who can explain that work, its cost and its effect on the plan gives a buyer confidence that’s so sought after in today’s market conditions.
How Intium Can Help
Our Open Source Software Scan helps owners and advisers identify product exposure and readiness gaps before a sale process begins, or during a buy-side technology due diligence exercise if no SBOM is available. We can:
Create missing SBOMs: build a Software Bill of Materials where none exists.
Assess security and license compliance: review software components for known vulnerabilities and license compliance issues.
Work with existing SBOMs: support CycloneDX, SPDX and SWID formats.
Preparing an exit? Get in touch to discuss CRA Exposure before diligence begins.
