The Cyber Resilience Act (CRA) significantly tightens the cyber security requirements for numerous products. The aim of the CRA is to create a uniform security standard for products with digital elements on the European market. The regulation is to apply directly in all EU member states from 2027. In this article, we explain what the CRA means for companies and give you tips on how to implement it.
For whom is the CRA relevant?
Manufacturers, importers and distributors of products with digital elements are affected. The term product with digital elements is to be understood broadly and includes software or hardware products including their backend systems. This includes, i.g. networked machines, IoT devices, apps, wearables, software and computer games, hard drives, firewalls, password managers, microprocessors with security-related functions, and many more. Only a few product types are exempt from the CRA.
What do companies need to prepare for?
The CRA obliges manufacturers of products with digital elements to fulfil certain cyber security and vulnerability management requirements:
- Risk assessment and control: Manufacturers must design and develop products with digital elements in such a way that an appropriate level of cyber security is guaranteed throughout the entire product life cycle. Numerous measures must be taken on the basis of a cybersecurity risk assessment. E.g., the products covered may only be placed on the market with a secure standard configuration and without known exploitable vulnerabilities.
- Vulnerability management and product monitoring: Manufacturers of products with digital elements must also fulfil far-reaching requirements for the handling of vulnerabilities. Fulfil vulnerabilities. Based on continuous monitoring of the products, manufacturers must eliminate known vulnerabilities through free security updates.
- Reporting obligations and documentation: Actively exploited vulnerabilities must be reported to the supervisory authority. The risk assessment and all remedial measures taken must be carefully documented.
- Cybersecurity in the supply chain: Cybersecurity must also be guaranteed in the supply chain. Compliance with the CRA usually requires comprehensive adjustments to contracts with suppliers and service providers.
Graduated obligations apply to importers and traders.
What are the penalties for violations?
The market surveillance authorities have far-reaching powers to investigate, remedy and impose sanctions. Violations of the CRA can result in product warnings and fines of up to 15 million euros or 2.5 per cent of annual global turnover.
What should companies do now?
The CRA will apply directly in all EU member states in 2027. However, in view of the diverse and complex requirements and the necessary preparation in product development, companies should immediately check whether their products are affected by the requirements of the CRA and clarify their role (manufacturer, importer or distributor) with regard to the respective products. A gap analysis should then be carried out to check which requirements relating to the product have already been fulfilled and which still need to be implemented. It is also advisable to review the contracts within the supply chain and adapt them to the new requirements.
Further information
- Our one-pager provides a compact overview of the key information on the Cyber Resilience Act and explains our support services.
- CRA Quick-Check: With our free Quick-Check you can check easily and without obligation whether your products are affected or not.