EU Cyber Resilience Act for Dubai Software and Device Makers: The Clock Already Started
Reporting under Regulation (EU) 2024/2847 went live on 11 September 2026 and CE marking lands 11 December 2027. What the CRA means for Dubai software and connected-product makers, with real AED costs.
- PUBLISHED
- 28 OCT 2026
- READ TIME
- 12 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
The EU Cyber Resilience Act applies to any company that places software or a connected product on the EU market — including a company headquartered in Dubai with no office in Europe. Its reporting obligations have been legally binding since 11 September 2026. The rest — secure-by-design processes, a software bill of materials, a declared support period and a CE mark — binds on 11 December 2027. Breaching the reporting duty alone carries administrative fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Here is what most UAE software and device businesses get wrong. They have written "December 2027" in a calendar and filed the rest under next year's problem. But the only CRA duty you can breach this month is the 24-hour one, and it triggers on an event you do not control: somebody actively exploiting a vulnerability in your product. Regulation (EU) 2024/2847 does not care that your technical documentation is not due yet.
Why a Dubai software company is in scope at all
Three numbers explain why this is a Dubai problem and not a Brussels one.
First, the trade. Non-oil trade between the UAE and the EU reached USD 67.6 billion in 2024, up 3.6% on 2023, and the EU accounts for roughly 8.3% of all UAE non-oil trade. Negotiations on a UAE–EU Comprehensive Economic Partnership Agreement opened in April 2025 and by July 2026 the UAE was publicly describing "non-trade matters" as the brake. That is the important distinction: a CEPA can move tariffs, but it does not move product regulation. CE-marking rules apply regardless of what any trade deal eventually says.
Second, the size of the exposed sector. The UAE ICT market was worth USD 43.33 billion in 2025 and is forecast to reach USD 152.38 billion by 2035, a 13.40% CAGR. Dubai alone concentrates more than 2,300 technology companies and over 3,500 startups with a combined value above USD 28 billion. Dubai Chamber of Digital Economy supported 1,690 digital startups in 2025, up 39.7% year on year, then 485 more in H1 2026 alone, up 57.5% — of which 51% were international companies and 23% were AI businesses. A meaningful slice of that cohort ships a connected device, a firmware image, a developer library or a mobile app into Europe.
Third, the price the European Commission itself put on the regime. Its impact assessment estimated aggregate compliance costs of up to roughly EUR 29 billion (about AED 120 billion) against products with digital elements worth up to EUR 1,485 billion (about AED 6.1 trillion) in turnover. Regulators do not spend that kind of number on a voluntary framework.
The dates, in order
| Date | What happens | Does it bind you now? |
|---|---|---|
| 10 December 2024 | Regulation (EU) 2024/2847 enters into force | Clock started |
| 11 June 2026 | Chapter IV applies — conformity assessment bodies can be notified | Infrastructure only |
| 11 September 2026 | Article 14 reporting obligations apply | Yes — live today |
| 31 October / 31 December 2026 | Deadlines for the core harmonised standards | Affects your assessment route |
| 11 December 2027 | Full application: essential requirements, SBOM, support period, CE marking, market surveillance | Not yet — but lead time is long |
One useful nuance: the reporting duty is not retrospective. If you were already aware of an active exploitation or severe incident before 11 September 2026, that specific event does not have to be reported. Anything you learn about after that date does.
What counts as a "product with digital elements"
The scope test is a connection, not a category. The CRA covers products whose intended or reasonably foreseeable use includes a direct or indirect data connection — connected consumer devices, business hardware, applications, operating systems, libraries and software components placed on the market independently.
Carved out: sector-specific regimes that already have their own cybersecurity rules (medical devices, motor vehicles, civil aviation) and non-commercial open-source software developed outside a commercial activity.
Then there is the question every Dubai SaaS founder asks, and the answer is more interesting than "exempt".
Pure SaaS — software that runs entirely on your infrastructure and that customers reach through a browser or API — is generally outside the CRA and sits in NIS2 territory instead. But under Article 3(2), a remote data processing solution is treated as part of the product when three conditions all hold: the data is processed at a distance, the product could not perform one of its functions without that processing, and the remote component is designed and developed by or under the responsibility of the manufacturer.
In practice, for a Dubai hardware or IoT business that means the cloud is in scope. A smart-building sensor whose readings are useless without your dashboard, a fleet tracker that depends on your backend, an EV charger that cannot authorise a session offline — the device and the control cloud are one product. A standalone HR or accounting SaaS with no device attached is not. If you ship devices on local M2M and IoT connectivity, assume the backend comes with them.
Your class decides how expensive this gets
| Class | Examples | Conformity route |
|---|---|---|
| Default | The large majority of products | Self-assessment (internal production control, Module A) |
| Important, Class I | Password managers, VPNs, network management software | Self-assessment only if harmonised standards or an EU certification scheme are applied; otherwise third party |
| Important, Class II | Operating systems, firewalls, microprocessors | Third-party assessment |
| Critical | Smart meters, smart cards, secure elements | Mandatory European cybersecurity certification |
Most UAE products land in the default class and can self-assess. That is the good news. The bad news is that self-assessment is not self-declaration: you still need the technical documentation, the risk assessment, the SBOM and the vulnerability handling process to exist and be auditable.
The part non-EU vendors get wrong: who actually files
If you have no main establishment in the EU, Article 14(7) sets a four-step cascade that decides which national CSIRT receives your report:
- The Member State where your authorised representative acting for the highest number of your products is established;
- failing that, the Member State of the importer placing the highest number of your products on the market;
- failing that, the Member State of the distributor making available the highest number of your products;
- failing that, the Member State where the highest number of users of your products are located.
Read that again, because two traps are hiding in it. The cascade decides the postbox, not the duty-holder — you remain responsible for filing. And if you have no authorised representative, step (d) means the answer can move between incidents as your user base shifts. Nobody wants to be recalculating "which country has the most of our users" during hour one of an active exploitation.
Appointing an authorised representative fixes step (a) and makes the answer stable. Note that under Article 18(1) an AR is optional under the CRA, unlike the EU medical devices regime, and that Articles 13(1) to 13(12) and 14(8) cannot be delegated to one. A standard off-the-shelf AR mandate will not cover Article 14 reporting unless it says so explicitly — have it drafted, not downloaded.
Your importers and distributors are not a shield either. Under Articles 19 and 20 they must inform you of known vulnerabilities without undue delay, and inform market surveillance authorities where a product poses a significant cybersecurity risk. They do not file your CSIRT notification.
Mechanically, reporting runs through the ENISA Single Reporting Platform, live since 11 September 2026 at portal.cra-srp.enisa.europa.eu. You file once; the coordinating CSIRT fans the notification out to CSIRTs in other affected Member States and to ENISA simultaneously.
The clocks you now run on
- 24 hours — early warning to the Single Reporting Platform once you have reasonable certainty of an actively exploited vulnerability or a severe incident.
- 72 hours — fuller notification, including corrective and mitigating measures.
- 14 days — final report for a vulnerability, once a fix is available.
- One month — final report for a severe incident, measured from the 72-hour notification.
If you are a UAE-licensed financial institution that also ships a device or app into Europe, you are now running two stopwatches from different trigger events: the Central Bank's four-hour notification under Operational Risk Management Regulation Circular No. 1/2026, and the CRA's 24 hours. Our guide to incident response and postmortems in Dubai covers how to run one process that satisfies both without duplicating the paperwork.
What CRA compliance actually costs
The Commission's own impact assessment is the most honest costing available, because it was built to justify the regulation rather than to sell a tool. Converted at AED 4.14 to the euro:
| Cost line | EUR | AED (approx.) |
|---|---|---|
| Secure development uplift — 30.5% on an average EUR 140,000 development cost | 42,700 | 177,000 |
| Self-assessment, average product | 18,400 | 76,000 |
| Third-party conformity assessment | 25,000 | 104,000 |
| Complex product, e.g. a router | 126,000 | 522,000 |
| One product, nothing in place, self-assessed | 61,100 | 253,000 |
That last line is the number to budget against, and it is before documentation effort. Against it, the Commission expects affected companies to see an annual aggregate reduction of EUR 180 billion to EUR 290 billion from the reduced impact of cybersecurity incidents. You will not see that benefit on your own P&L in year one. You will see the cost.
The support period is the trap nobody prices
From 11 December 2027 you must declare a support period of at least five years, or the expected use time of the product where that is shorter. During it, security updates are free of charge. You must also maintain an SBOM in a commonly used, machine-readable format, and run a coordinated vulnerability disclosure policy.
Here is the arithmetic most teams have not done: a five-year promise on a product shipping in 2028 runs to 2033, and the upstream open-source libraries inside it very often do not. Your obligation does not expire when a dependency reaches end of life — you inherit the patching. That turns the support period into a procurement decision about which libraries you are willing to be married to, made years earlier.
This is where the groundwork pays off. If you already have SBOM generation in your pipeline and a working vulnerability disclosure programme, two of the four 2027 requirements are mostly built. If you do not, start there rather than with the CE mark.
UAE exporters should also recognise the pattern. The CRA is the third EU regulation in three years to make a data obligation a condition of market access, alongside the Digital Product Passport under ESPR. The compliance muscle is the same one.
What a CRA programme costs in Dubai
Typical AED ranges we quote UAE software and connected-product businesses:
| Scope | What it includes | AED |
|---|---|---|
| Scope and classification assessment | Are you in scope, which class, which conformity route, Article 3(2) cloud analysis | 12,000 – 25,000 |
| Article 14 reporting runbook | CSIRT cascade determination, AR mandate review, 24/72-hour playbook, on-call ownership | 18,000 – 40,000 |
| SBOM and VEX pipeline | Machine-readable SBOM per build, dependency inventory, exploitability triage in CI | 30,000 – 75,000 |
| Support-period and EOL audit | Dependency end-of-life mapping, LTS strategy, declared support period you can honour | 20,000 – 55,000 |
| Secure-by-design remediation and technical file | Risk assessment, essential-requirements gap closure, documentation pack for self-assessment | 90,000 – 260,000 |
Now the cost of inaction, which is where this stops being a compliance conversation. The fine ceiling for breaching essential requirements or manufacturer obligations is EUR 15 million or 2.5% of total worldwide annual turnover — roughly AED 62.1 million at the fixed ceiling, and for a growing company the turnover percentage bites harder every year. Beyond the fine, non-compliant products come off the market until they comply. For a Dubai business whose European channel is part of the 8.3% of UAE non-oil trade that runs to the EU, a market-access stop is not a line item, it is the quarter.
How Aquarius does it
We treat the CRA as two separate projects with two separate deadlines, because that is what it is. Project one is the reporting duty that is already live: determine your Article 14(7) CSIRT, register on the ENISA platform, write the 24-hour runbook, and name the person who owns the pager. That is weeks of work, not months, and it closes the only exposure you currently have.
Project two is 11 December 2027: classify the product, pick the conformity route, generate SBOMs on every build, map dependency end-of-life against the support period you intend to declare, close the essential-requirements gaps, and assemble the technical file. We sequence it so the engineering work lands as normal backlog over four quarters rather than as a compliance panic in Q3 2027.
The scope and classification assessment is fixed-price and yours outright, whether or not you build with us — it tells you if you are even in scope, which is the one question nobody should be guessing at. See our pricing.
FAQ
Does the Cyber Resilience Act apply to a Dubai company with no EU office?
Yes. The CRA is market-access legislation: it attaches to placing a product with digital elements on the EU market, not to where the manufacturer is established. A non-EU manufacturer must ensure an EU economic operator takes on the relevant obligations, and Article 14(7) sets out which national CSIRT receives your reports when you have no EU establishment.
Is our SaaS exempt from the CRA?
Probably, but check the test rather than assuming. Software delivered purely as a service from your own infrastructure is generally outside the CRA and falls under NIS2 instead. Under Article 3(2), however, remote data processing is treated as part of a product where the data is processed at a distance, the product could not perform one of its functions without it, and the manufacturer designed or is responsible for it. If you sell a device and your cloud makes it work, the cloud is in scope.
Do we need an authorised representative in the EU?
It is optional under Article 18(1), unlike the medical devices regime. It is still usually worth it, because appointing one fixes the first step of the Article 14(7) cascade so you know in advance which CSIRT you file with. Make sure the mandate explicitly covers Article 14 reporting; Articles 13(1) to 13(12) and 14(8) cannot be delegated at all.
What do we actually have to do before 11 December 2027?
Secure-by-design development processes, a machine-readable SBOM, a coordinated vulnerability disclosure policy, a declared support period of at least five years with free security updates, a conformity assessment appropriate to your product class, technical documentation, and the CE mark. Until that date, only the Article 14 reporting obligation binds.
How much does CRA compliance cost in AED?
The European Commission's model puts a single self-assessed product with nothing in place at about EUR 61,100 — roughly AED 253,000 — comprising EUR 42,700 of secure development uplift and EUR 18,400 of self-assessment, before documentation. A product needing third-party assessment substitutes EUR 25,000 for that second figure, and a complex product such as a router was modelled at EUR 126,000, about AED 522,000. In Dubai, a scoping assessment and an Article 14 runbook together typically run AED 30,000 to AED 65,000.
The takeaway: the CRA deadline that matters to a Dubai software or device business is not 11 December 2027 — it is whichever morning somebody starts exploiting your product, because the 24-hour clock has been running since 11 September 2026. Determine your CSIRT, write the runbook, and then spend 2027 earning the CE mark on a normal schedule. Talk to Aquarius about a fixed-price CRA scope and classification assessment.