April 7, 2026 CRA Guide 6 min read

Cyber Resilience Act: What Shopify Merchants Must Do Before September 2026

Last updated: April 7, 2026

The Cyber Resilience Act (Regulation 2024/2847) introduces mandatory cybersecurity requirements for products with digital elements sold in the EU. Reporting obligations start September 11, 2026. Here's what it means for your Shopify store.

What is the Cyber Resilience Act?

The CRA is an EU regulation that establishes cybersecurity requirements for hardware and software products sold in the European market. While it primarily targets manufacturers and software vendors, e-commerce stores that sell digital products or use third-party digital tools are also affected.

For Shopify merchants, the CRA matters because your online store is a digital product that handles customer data, processes payments, and integrates with third-party services.

Key CRA requirements for Shopify stores

Incident reporting (24-hour requirement)

If your store experiences a security incident that affects EU customers, you must report it to the relevant authorities within 24 hours. This means you need:

A documented incident response plan
A designated security contact
A way for customers to report security concerns
Clear communication procedures for breach notification

Third-party script security

Every third-party script on your store — analytics, chat widgets, marketing pixels, payment processors — must be documented and their security practices assessed. The CRA requires you to understand and disclose the security implications of your third-party integrations.

Payment data security

Your privacy policy must explicitly address how payment data is handled, what security measures are in place, and whether PCI compliance standards are met. Shopify handles much of this, but you must disclose it clearly to customers.

Data handling and encryption

The CRA requires clear documentation of:

How customer data is encrypted in transit and at rest
Data retention policies and timelines
Cross-border data transfer practices
Data processing agreements with third parties

Vulnerability management

You must have processes for identifying and addressing security vulnerabilities. This includes:

A vulnerability disclosure policy
Regular security assessments
A security contact page or email
Documentation of software update practices

Timeline

September 11, 2026 — Reporting obligations begin
December 11, 2027 — Full conformity assessment requirements

What to do now

Create a security incident response page on your store
Add a security contact (email or form) for vulnerability reports
Document your third-party integrations and their security practices
Update your privacy policy with data handling specifics
Add a vulnerability disclosure policy to your store
Review and document your data retention practices

Complyo's CRA scanner checks all of these requirements automatically and provides specific fix suggestions for each gap found in your store.

CRA vs GDPR: What's the difference?

GDPR focuses on personal data protection. The CRA focuses on cybersecurity of digital products. They're complementary — you need both. If you're GDPR-compliant, you have a head start on CRA, but there are additional requirements around incident reporting, vulnerability management, and security documentation that GDPR doesn't cover.