{
  "id": 10702807,
  "title": "What Irish tech companies need to know about the EU’s CRA",
  "url": "https://urgent.news/2026/09/29/what-irish-tech-companies-need-to-know-about-the-eus-cra",
  "topic": "business",
  "section": "Business",
  "published": "2026-09-29T14:00:22.000Z",
  "source": {
    "name": "Silicon Republic",
    "slug": "silicon-republic",
    "url": "https://www.siliconrepublic.com/enterprise/what-irish-tech-companies-need-to-know-about-the-eus-cra"
  },
  "original_language": "en",
  "account": "The EU's Cyber Resilience Act (CRA) introduces obligations for Irish tech companies developing or marketing software with digital elements. The Act's first deadline, on September 11th, activated reporting requirements for any Irish company in scope, regardless of product monetisation. Products must be secure by design, default, and throughout their lifecycle. Companies must act swiftly upon discovering vulnerabilities or incidents, notifying the relevant national CSIRT within 24 and 72 hours, respectively. Reports are filed through the ENISA Single Reporting Platform. Non-compliance may result in fines ranging from 2.5% of yearly turnover to €15 million. Companies must incorporate security risk assessments from the outset and ensure suppliers provide comparable assurances. Continuous vulnerability checks, SBOMs, and clear vulnerability disclosure policies are essential. The CRA applies directly, superseding Ireland's own cybersecurity legislation, and poses significant risks for companies failing to comply.",
  "summary": "ServiceNow’s Anna Mazzone discusses obligations of the Cyber Resilience Act and why more Irish software firms may be in scope than most realise. Read more: What Irish tech companies need to know about the EU’s CRA",
  "key_points": [
    "Irish tech firms must secure software by design and default.",
    "24-72 hour reporting to CSIRT required for vulnerabilities/incidents.",
    "Non-compliance faces fines up to €15 million or 2.5% of turnover."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}