Digital products are now found in every aspect of our lives: from software and operating systems to smartphones, routers, smart home devices, wearables and smart cards – they are indispensable building blocks of our everyday lives and the modern economy. However, as their importance grows, so too does the attack surface for cybercriminals. This opens up entry points for attackers – into private households as well as critical corporate systems.
This is precisely where the Cyber Resilience Act (CRA) comes in: the EU is tightening IT security requirements across all sectors for products containing digital elements. Manufacturers, importers and distributors must prepare for significantly stricter cybersecurity requirements. The only exceptions are products that are already subject to specific EU regulations, such as those in the medical or aerospace sectors, as well as spare parts and prototypes.
The regulations cover the entire product life cycle: from development through to deployment and ongoing maintenance. There are also new documentation and reporting requirements to be met. Affected companies are therefore faced with a comprehensive set of new obligations, which requires a careful review and adaptation of their products and processes. Those who act early will gain a competitive advantage by strengthening the trust of customers and business partners.
What companies can expect in practical terms
- At the heart of the CRA is the principle of “secure by design and by default”: cybersecurity must be taken into account right from the product development stage and throughout the entire product lifecycle. This includes, amongst other things, secure default configurations, ongoing vulnerability management and the obligation to provide security updates for at least five years.
- Manufacturers must issue EU declarations of conformity regarding their products’ compliance with the CRA, followed by CE certification and marking. Stricter regulations apply to key products such as operating systems, smart home devices with security functions, wearables, and critical products such as smart meter gateways and smart cards.
- The CRA also sets out supply chain security obligations: manufacturers must vet their suppliers and be able to provide technical documentation – for example, in the form of a Software Bill of Materials (SBOM).
- In the case of vulnerabilities, there are reporting and disclosure obligations under certain conditions. The deadlines are very short: the initial report must be made within 24 hours. Without careful preparation, it is effectively impossible to meet these deadlines.
- Furthermore, companies must fulfil information and guidance obligations towards users.
Digital Product Compliance
The CRA is another piece of the jigsaw in the increasingly complex landscape of digital product compliance, which may also encompass, amongst other things, the Data and AI Act, DORA and NIS-2. Whilst NIS-2 – or DORA for financial firms and third-party ICT service providers – addresses the cyber security of the entire organisation, the CRA focuses on product security. For (future) organisations subject to NIS-2, this gives rise to various interdependencies. Among other things, CRA-compliant certified products help to demonstrate supply chain security as part of risk management under NIS-2.
Phased implementation
The obligations will be phased in gradually. The reporting obligation comes into force on 11 September 2026, followed by the remaining conditions:
Need for action
Given the scope of the new obligations, it is essential that organisations now review their CRA compliance without delay and implement any necessary changes. This is also important in view of the potential penalties for non-compliance. As with NIS-2, there is a risk of heavy fines: for serious breaches (e.g. failure to comply with key cybersecurity or reporting obligations), up to EUR 15 million or 2.5 per cent of global turnover; for other breaches, up to EUR 10/5 million or 2/1 per cent of global turnover (whichever is higher). In addition, the Unfair Competition Act applies here too if the rules are not followed.
What to do now:
Our DORDA experts will be happy to support you with their practical experience and keep you up to date with the latest developments.