Cyber Resilience Act: what it means for your TYPO3 agency
Your role per deliverable, what you ship, the basics to set up, and how to run it in client projects. Four steps for agencies and extension vendors, with the source behind every statement.
- Know your role for each deliverable: website, extension, code for a client
- Map products, versions, components and support end dates in one register
- Set up contact, updates and the reporting clock, and settle duties in contracts
What do you need first?
It depends on what you deliver. A client website that only presents information is not a product; an extension you sell is; code handed to a client can count as placed on the market. Guide pages 4 and 5.
One row per product version you supply, with a support end date (at least five years unless use is shorter) and an owner. Guide page 7.
composer audit for known advisories, the CycloneDX plugin for a machine-readable SBOM per release. It does not have to be published. Guide page 8.
Actively exploited vulnerability: early warning in 24 hours, notification in 72 hours, final report 14 days after a fix, through the ENISA Single Reporting Platform. Guide page 10.
Six topics to settle with counsel: who is manufacturer of custom code, support period, components, reporting, handover, later changes. Guide page 11.
Nine questions to send to every extension vendor you integrate, from support end date to SBOM. Guide page 12.
This guide is orientation, not legal advice. Settle your role for each product in writing, with counsel.
Get the guide and the CRA register, free
PDF and Excel file, instant download. We only email you about this guide.
How we use your details: Privacy Policy.
Questions about the Partner Program before you download? Write to Sophia: sales@t3planet.de
What does the Cyber Resilience Act mean for a TYPO3 agency?
- The Cyber Resilience Act, Regulation (EU) 2024/2847, sets security rules for products with digital elements, including software supplied to users. It regulates products, not agencies.
- A website that only presents information is not a product under the CRA; an extension you sell or license for a fee is, and you are its manufacturer (Commission guidance C(2026) 5252).
- Code you hand over to a client can count as placed on the market, so settle in the contract who is the manufacturer and who fixes vulnerabilities for how long.
- Manufacturers report actively exploited vulnerabilities and severe incidents in three stages (early warning within 24 hours, notification within 72 hours, then a final report) through the ENISA Single Reporting Platform; this applies since 11 Sep 2026.
- The remaining obligations apply to products placed on the market from 11 Dec 2027: secure design, support period of at least five years, SBOM, documentation and declaration of conformity.
This guide is orientation, not legal advice. Settle your role for each product in writing, with counsel.
Three questions agencies ask first
Turn a card to see what the guide says.
We build and maintain client websites. Is the website a CRA product?
We wrote a custom extension for one client.
Our free extension in the TER also has a pro edition.
Sources: Regulation (EU) 2024/2847, Art. 13, 14, 71; Commission guidance C(2026) 5252. As of 20 October 2026.
Five people, one register
Pick a role to see what it covers.
Agency lead
- Owner
- Owner or managing director
- Covers
- Decides the role per deliverable with counsel, signs the contract clauses, talks to clients.
- Guide
- Steps 1 and 4
The register has an owner column per product. Put a real name in it, not a role.
Lead developer
- Owner
- Technical lead
- Covers
- Keeps the register, composer.lock and SBOM per release, runs composer audit, owns the security release path.
- Guide
- Steps 2 and 3
The register has an owner column per product. Put a real name in it, not a role.
Product owner
- Owner
- Per extension you sell
- Covers
- Support period and end date, disclosure policy, user information, the reporting runbook.
- Guide
- Step 3
The register has an owner column per product. Put a real name in it, not a role.
Counsel
- Owner
- Your lawyer
- Covers
- Open cases from the role check and the six contract topics. The guide lists the questions.
- Guide
- Steps 1 and 4
The register has an owner column per product. Put a real name in it, not a role.
Client
- Owner
- Site owner
- Covers
- Knows what the website is and is not, what maintenance covers and who reports.
- Guide
- Step 4
The register has an owner column per product. Put a real name in it, not a role.
Seventeen pages, four steps, one register
The CRA in five minutes
What it covers, what it does not, and the two dates.
Know your role
Role per deliverable, four cases from agency work, what a manufacturer must do.
Map what you ship
The register, components, composer audit and the SBOM.
Set up the basics
Security contact, disclosure, security releases, the reporting clock.
Run it in projects
Contract topics for counsel, nine vendor questions, what to tell clients.
Checklist and sources
Ten steps in order, where T3Planet helps, every source.
This guide is orientation, not legal advice. Settle your role for each product in writing, with counsel.
Four steps, from role to client contract
Know your role
Per deliverable, not per agency.
- Website, extension or code for a client
- Sold, licensed or monetised?
- Open cases to counsel
Map what you ship
Products, versions, components.
- Support end date per version
- An owner per product
- composer.lock and SBOM per release
Set up the basics
Contact, disclosure, updates.
- security.txt and a role inbox
- Security releases kept separate
- User information ready
Reporting clock
24 h, 72 h, final report.
- Two named people on call
- Platform account ready
- Users informed
Run it in projects
Contracts, vendors, clients.
- Six topics for counsel
- Nine vendor questions
- Plain words for clients
Pages from the guide, EN edition.
One row per deliverable, product and report
Role check per deliverable, products and versions with support end dates, components with audit dates, vendor answers and a reporting log. A checklist and a summary fill themselves.
- Dropdowns for roles and answers, colour for open cases
- A filled example for a fictional agency
- Opens in Excel, LibreOffice and Google Sheets
T3Planet Partner Program
For agencies, freelancers and IT firms that use T3Planet products in client projects: spend-based tiers with a discount on product subscriptions, a partner badge and a directory listing.
Sophia · Sales & Partnerships at T3PlanetWho it is for
TYPO3 agencies and freelancers
You build and maintain client sites, sometimes with custom extensions. You get a role check per deliverable, contract topics for counsel and words for clients.
Extension vendors and in-house teams
You publish or sell your own extensions. You get the manufacturer duties in plain words, a register, the SBOM route and the reporting clock.
Frequently asked questions
Does the Cyber Resilience Act apply to TYPO3 agencies?
The CRA regulates products, not agencies. What you deliver decides: a client website that only presents information is not a product, an extension you sell or license for a fee is, and code you hand over to a client can count as placed on the market. The guide checks each case.
Is the guide really free?
Yes. You get the PDF and the Excel CRA register straight away, with no payment details.
Are free TER extensions covered?
Free and open-source software that is not monetised is not placed on the market. A paid edition, or a download tied to payment, is. Contributors without decision power over releases carry no CRA duties for their contributions.
What are the CRA reporting deadlines?
For an actively exploited vulnerability: an early warning within 24 hours, a notification within 72 hours and a final report within 14 days after a fix is available. For a severe incident the final report is due within one month of the notification. Reports go through the ENISA Single Reporting Platform.
When does the CRA apply?
Reporting applies since 11 Sep 2026, also for products already on the market. The remaining obligations apply to products placed on the market from 11 Dec 2027.
Is this legal advice?
No. This guide is orientation, not legal advice. Settle your role for each product in writing, with counsel.