As products continue to evolve towards greater digitalisation and connectivity, they increasingly become targets for cyber threats, as we've illustrated in our previous article. The EU has recognised this threat and is now responding with a new piece of legislation – the European Cyber Resilience Act (CRA). This act outlines a series of preventative measures that are aimed at improving the cybersecurity of products made available in the EU.

In this article, we will discuss who is affected by the CRA, what product adjustments should be made to fulfil the new cybersecurity requirements, and what documentation and processes should be prepared internally to ensure compliance with this new legislation.

The CRA, or Cyber Resilience Act, is an upcoming piece of EU legislation that aims to enhance the cybersecurity of ‘products with digital elements’. In practice, the law covers all products that exchange data with another device or network. The law also covers any remote data processing that is part of a product, such as the use of a cloud backend.

The CRA outlines minimum requirements for the security of these products. It also mandates manufacturers to follow specific processes for product development and support. If your company manufactures, imports, or distributes a product that is available in the EU and that performs any type of data communication, you are most likely affected by the CRA.

After long negotiations, the CRA is now in the final steps of its legislative process. It was accepted by the EU parliament on March 12, 2024, and is expected to enter into force in mid-2024. Next, compliance requirements will be introduced in two steps:

• 21 months after final adoption (i.e. early 2026), compliance with the reporting requirements of the text (see below) will be required.
• 36 months after final adoption (i.e. mid 2027), full conformity by manufacturers, importers, and distributors will be required.

Although these grace periods may seem generous at first, this impression can be deceiving. The CRA’s stipulations could significantly impact your development and support workflows, and timely implementation of the required changes may demand considerable effort. Moreover, it is critical to ensure that these changes are supported by all levels of the organisation. That’s why we strongly advise to allocate sufficient time for a phased approach to achieving CRA compliance, instead of rushing the process.

Depending on the type of violation, failure to conform to the CRA can incur fines of up to 15 million euros, or 2.5% of a company’s worldwide annual turnover, whichever is higher. So, it’s definitely worth planning for CRA compliance as soon as possible.

CRA vs NIS2

What distinguishes the CRA from the EU’s NIS2 directive is its focus on products. Although both the CRA and NIS2 aim to improve the cyber security stance of the union, the CRA takes a fundamentally different approach. Concretely, while the CRA regulates product security, NIS2 regulates the security practices of critical organisations, such as utility companies and manufacturing plants.

Moreover, even though NIS2 uses the term ‘critical’ liberally, many more organisations will be affected by the CRA than by NIS2. Most notably, organisations outside the EU are not typically subject to NIS2 but are subject to the CRA if their products are made available in the EU. This is similar to how the GDPR affects companies outside of the union if they target their services at union residents.

CRA vs RED

The Radio Equipment Directive (RED) is a regulatory framework for placing radio equipment on the EU market. In 2022, an amendment was added, outlining security requirements for internet-connected radio equipment and radio equipment that processes data. More specifically, depending on the type of device involved, the amendment requires radio equipment to protect users against privacy loss and fraud, and to protect networks against disruptions. These changes will be effective from August 2025 onwards.

Unlike the RED, the CRA applies to any product with digital elements, not just to radio equipment. In addition, although aligned with the cybersecurity requirements of the RED, the requirements specified in the CRA are far more extensive and comprehensive. It is likely that, over time, the CRA will replace the security requirements of the RED.

Update 25.10.2024: We removed a statement about “products already available on the market”, as it is prone to misinterpretation. In principle all products sold on the EU market after the CRA grace period must be fully CRA-compliant.

Crucially, the CRA does not distinguish between products originating from countries within and countries outside of the EU, it simply covers all products ‘made available on the EU market’. So, the CRA fully applies to companies based in non-EU countries when they intend to release their products in the EU. To guarantee accountability throughout the entire supply chain, the law includes several requirements for importers and distributors.

Depending on the type of product, there are different options available for demonstrating CRA compliance. For most products, manufacturers can simply self-declare that the necessary requirements were met. In this case, it is important to remember that the product’s technical documentation ensures that this declaration can be audited later, e.g. after an incident has occurred.

Beyond this self-declaration mechanism, the CRA foresees several other ways to demonstrate regulatory adherence. These come in to play for the so called ‘important’ or ‘critical’ products, depending on a product’s classification, only a subset of the mechanisms may be used. These additional mechanisms are (ordered by increasing assurance level):

• Adherence to harmonised standards: Conformity is demonstrated by following a so-called harmonised EU standard, followed by the self-declaration procedure.
• A type-examination based mechanism: Manufacturers obtain a type certification from an EU-designated third party and then declare products to be conforming to the type.
• Conformity based on full quality assurance: The manufacturer applies a purpose-certified internal quality management system throughout the product’s design and manufacturing process.
• A European cybersecurity certification scheme: The cybersecurity of the product is certified by the European Union Agency for Cybersecurity (ENISA).

The classification of a product into the ‘important’ or ‘critical’ categories is done based on a predefined list. This list can be updated by the European Commission at any point in time, with changes valid after 12 months. Current examples of products included in this list are password managers, smart home products with security functionality (e.g. smart door locks, security cameras), smartcards, and firewalls.

For most of these products, following a harmonised standard (if permitted) will likely be the most straightforward way to demonstrate compliance. However, the ongoing experience with the creation of harmonised standards for the RED has demonstrated that these standardisation procedures can be complex and time-consuming. Moreover, the CRA includes many more requirements than the RED. As such, it is currently unclear if the harmonised standards for the CRA will be completed in time. Although the CRA includes provisions for delayed harmonised standards, it is currently not clear what would happen in such a scenario.

The CRA’s requirements are comprehensive and touch on many aspects of product development and delivery. For many companies, achieving compliance might be a lengthy process. As such, we encourage organisations to begin their journey towards CRA compliance as soon as possible.

If you want to start your compliance process with us, we’d be happy to hear from you. With our team of cybersecurity experts, we can help you comply with all the requirements, provide advice on addressing vulnerabilities, and conduct security assessments of your products. Moreover, because of our decades-long experience in all aspects of product design, we are experts at balancing security and non-security needs. Together, we will find a solution that is custom-made to your problems.