Expertise · Regulation
Cyber Resilience Act (CRA)
EU security requirements for products with digital elements — secure-by-design, vulnerability handling, and lifecycle obligations for anyone making or selling connected hardware and software.
What it is, and why it matters.
The Cyber Resilience Act introduces mandatory cybersecurity requirements for "products with digital elements" — hardware and software that connect to a device or network. Manufacturers must build security in by design, handle vulnerabilities across the product's lifecycle, provide security updates, and demonstrate conformity (including CE marking). It also introduces obligations to report actively exploited vulnerabilities and severe incidents. Importers and distributors carry duties of their own. For product makers, the CRA shifts cybersecurity from optional to a condition of access to the EU market.
Who it affects.
Manufacturers, importers, and distributors of connected products placed on the EU market — from IoT devices and components to standalone software. If you make or sell digital products, the CRA very likely affects you.
Key dates
Entered into force in late 2024, with obligations phasing in — vulnerability and incident reporting obligations applying first, and the main body of requirements applying later.
Key obligations.
Security-by-design and by-default across the product lifecycle
Vulnerability handling and coordinated disclosure
Security updates for a defined support period
Conformity assessment and CE marking
Reporting of actively exploited vulnerabilities and severe incidents
Sits under:
Compliance
Cyber Resilience Act (CRA) within your managed office.
The CRA sits under Compliance and connects strongly to Architecture & Transformation (secure development and product architecture) and Risk. We manage it as part of your program so product security and organisational security reinforce each other.
How we help.
00
Product scoping
Which products are in scope, and in which category.
00
Gap analysis
Where your products stand against CRA requirements.
00
Secure development lifecycle
Building security into how products are made.
00
Vulnerability handling
Coordinated disclosure and lifecycle processes.
00
Reporting readiness
Meeting the vulnerability and incident reporting duties.
00
Conformity documentation
The evidence and documentation conformity needs.
Related expertise.
EU AI Act
The world's first comprehensive AI regulation — a risk-based framework with obligations that scale from transparency to strict conformity, for organisations that build or use AI.
ISO 27001
The international standard for information security management. We design, implement, and run the ISMS — and take you to certification and beyond.
TRUSTED BY ORGANISATIONS ACROSS EUROPE
