From 2027, the Cyber Resilience Act (CRA) will make cybersecurity a mandatory requirement for most connected hardware and software products in the EU.
The Cyber Resilience Act is a new EU regulation designed to improve the cybersecurity of digital products placed on the European market. It applies to hardware and software that are – or can be – connected to a network or the internet. The CRA aims to ensure that:
In other words: cybersecurity becomes a core product requirement, not an optional extra.
The CRA covers a wide range of companies that bring digital products to the EU market – regardless of company size.
You design or develop connected hardware or software – for example IoT devices, embedded systems, industrial controllers, apps or standard software. As a manufacturer, you are responsible for risk assessments, secure development practices, vulnerability management, documentation and long-term security updates.
You import connected products into the EU or resell them as a distributor, system integrator or retailer. You must verify that the products you place on the market are CRA-compliant, correctly CE-marked and properly documented. In some situations, you may even be considered the manufacturer.
You operate machines, devices or systems that rely on networked digital components. Even if you don’t manufacture products yourself, CRA obligations will influence your procurement, contracts and risk management – and shape the questions you should ask your suppliers.
Answer a few questions and get a quick, non-binding assessment of how strongly the CRA may affect your digital product and your role in the supply chain.
Unsubscribe anytime in just a few clicks.
