Understanding the Cyber Resilience Act (CRA)
The EU Cyber Resilience Act (CRA), which entered into force on December 10, 2024, aims to enhance the security of hardware and software products within the European market. The act introduces mandatory cybersecurity requirements for digital products to mitigate vulnerabilities that could be exploited by cyber threats.
Manufacturers, importers, and distributors of digital products—including IoT devices, embedded systems, and software applications—must ensure compliance with these new regulations to continue selling in the EU.
The CRA primarily applies to new products, but from September 2026, manufacturers must report vulnerabilities and significant security incidents if their products are still actively marketed in the EU. This means that existing products in the market beyond this date will also be impacted, encouraging early alignment with CRA requirements.
Additionally, the CRA broadly defines products with digital elements (PDEs) to include any hardware or software products, including their remote data processing solutions and software or hardware components that are marketed separately. This means that even standalone components and cloud-based solutions fall within the scope of CRA compliance.
Key Requirements of the CRA
The CRA establishes essential cybersecurity standards related to product security and lifecycle management. As outlined in Embedded Use’s analysis, the act introduces strict obligations for product development, maintenance, and long-term security. Key aspects include:
- Secure by Design – Products must be developed with security in mind from the outset, minimizing attack surfaces and ensuring resilience against known vulnerabilities.
- Vulnerability Handling – Manufacturers must provide timely security updates and patches for at least ten years after the product’s release.
- Incident Reporting – Security incidents and vulnerabilities must be reported to EU cybersecurity authorities within 24 hours of detection.
- Product Lifecycle Security – Security measures must be maintained throughout the product’s lifecycle, including end-of-life considerations.
- Supply Chain Security – Companies must ensure that all components, including third-party software and libraries, meet CRA security requirements.
More details on how these product security requirements affect embedded software development and lifecycle management can be found in the Embedded Use article.
Impact Overview
For companies developing connected devices, embedded systems, and software applications, the CRA introduces new challenges in product design, security assurance, compliance documentation, and lifecycle management.
Some industries directly impacted include:
- Smart Home & Industrial IoT – Devices must implement secure communication protocols, regular security updates, and clear cybersecurity guidance for users.
- Enterprise Software & Cloud Solutions – Applications handling user data must ensure end-to-end encryption, strict access control, and continuous vulnerability management.
Adjustments for CRA Compliance: A Use Case Example
To illustrate the practical impact of CRA compliance, let’s consider an IoT product—a Raspberry Pi-based device running Linux, paired with a mobile app that syncs data via AWS cloud services.
This product would need the following adjustments to meet CRA requirements:
- Secure Software Updates – Implementing a robust over-the-air (OTA) update mechanism that ensures security patches for at least ten years.
- Data Protection & Encryption – Encrypting stored and transmitted data to prevent unauthorized access.
- Vulnerability & Incident Handling – Establishing a security monitoring and incident response framework to meet the 24-hour reporting requirement.
- Compliance Testing & Documentation – Conducting regular penetration testing, maintaining compliance documentation, and proving security resilience in audits.
Additional Costs & Efforts for CRA Compliance
Meeting CRA requirements will increase both development and operational costs for companies providing software and IoT solutions. Key areas requiring investment include:
- Security Infrastructure Upgrades – Implementing secure boot, encrypted storage, and authentication mechanisms.
- Extended Product Lifecycle Support – Ensuring firmware updates and long-term vulnerability management.
- Legal and Compliance Efforts – Preparing technical documentation, security audits, and regulatory filings.
- Supply Chain Validation – Ensuring third-party components and dependencies also comply with CRA standards.
For a product like our IoT example, CRA compliance could add several thousands euros in additional costs, depending on its complexity and existing security infrastructure. These costs aren’t limited to new products—legacy products already on the market may require updates, patches, and even redesigns to meet CRA standards.
While compliance increases upfront costs, it also provides long-term benefits: a more secure product, better resilience against cyber threats, and reduced risk of reputational or operational damage.
Next Steps: Preparing for CRA Implementation
The CRA will be fully enforced from December 11, 2027, with a phased transition period for companies to adapt. Organizations should start planning now by:
✅ Reviewing existing products for compliance gaps ✅ Implementing secure development practices ✅ Establishing vulnerability monitoring & response processes ✅ Aligning with industry best practices for cybersecurity.
Final Thoughts
The EU Cyber Resilience Act sets a new cybersecurity benchmark for software and connected devices. Companies that take proactive steps now will be better positioned to maintain market access in the EU.
For IoT and embedded software developers, integrating secure coding practices, automated vulnerability detection, and long-term security maintenance is crucial for future-proofing products and ensuring compliance.
The CRA is a major regulatory shift that will shape the future of cybersecurity in digital products. Whether you are working on new product development or managing existing products, now is the time to adapt to these new security requirements and prepare for compliance.
By implementing secure development strategies today, companies can mitigate risks, reduce costs, and build trust with customers and regulators alike.