Read our latest case study on how a Gen-AI-enabled workflow can transform a generic repair activity into a root-cause and product improvement intelligence
A deep dive into the Cyber Resilience Act
The Cyber Resilience Act is best understood as a product-lifecycle regulation. It does not merely ask whether a device has a password; it asks whether a manufacturer can design, build, maintain, monitor, update, and eventually retire a connected product securely—and prove it.
LIBRARY MANAGEMENTCUSTOMER SUCCESSPCB DESIGNSCHEMATIC ENTRYELECTRONIC SYSTEM DESIGNAICUSTOMER SUPPORTPCB MANUFACTURING
Atanu
10/30/20262 min read
A deep dive into the Cyber Resilience Act
The Cyber Resilience Act is best understood as a product-lifecycle regulation. It does not merely ask whether a device has a password; it asks whether a manufacturer can design, build, maintain, monitor, update, and eventually retire a connected product securely—and prove it.
Scope and roles
The CRA applies to products with digital elements made available on the EU market. This includes connected hardware, software products, firmware, and components supplied separately. It can also capture remote data-processing solutions where the product cannot function without them.
A company may hold several roles at once: manufacturer, importer, distributor, or even open-source steward. The duties differ by role, so the first exercise is not “Are we compliant?” but “What role do we have for each product and distribution channel?”
Classification and conformity
Most products are expected to follow a self-assessment route. However, classification matters:
Product category & Typical conformity route
Default products -> Self-assessment
Important Class I -> Self-assessment where applicable harmonised standards, common specifications, or a recognised certification scheme are applied in full; otherwise third-party assessment
Important Class II -> Notified-body assessment, or a recognised EU cybersecurity certification scheme once available
Critical products -> Notified-body assessment, or a recognised certification scheme once available
As of mid-October 2026, no CRA notified bodies had been designated, and no harmonised standards had been cited in the Official Journal. Companies should therefore document compliance directly against Annex I rather than assume a standards-based shortcut exists today.
Annex I in engineering terms
Annex I requirements translate into concrete controls:
Risk assessment: maintain a product-specific threat model, not a generic corporate security policy.
Secure development: control source code, build pipelines, dependencies, secrets, and release artefacts.
Secure configuration: remove default credentials, disable unnecessary services, and enforce least privilege.
Vulnerability management: monitor components, triage reports, issue fixes, and publish advisories.
SBOM: know every software component and dependency in each shipped version.
Updates: sign updates, protect the delivery channel, and make installation reliable.
Logging: capture security-relevant events without creating an unmanaged privacy or storage burden.
Support: define and publish the support period.
The support-period rule
The often-quoted “five years” is a default, not a universal maximum. The support period must reflect the product’s expected lifetime. A consumer accessory expected to last three years may justify a shorter period; an industrial controller expected to operate for 12 years may require longer.
There is also a separate retention rule: each security update issued during the support period must remain available for at least ten years after issue, or for the rest of the support period if that is longer. Manufacturers should state the end-of-support date—at least month and year—at the point of sale.
Reporting: already live
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform. The early-warning notification is due within 24 hours of awareness. This applies to products already available on the EU market, including legacy products.
A practical readiness test is simple: can your team identify affected product versions, determine exposure, prepare an initial report, and communicate a remediation plan within one day? If not, the gap is operational, not legal.
CE marking and evidence
From 11 December 2027, CRA compliance becomes a market-access requirement. Manufacturers will need technical documentation, a conformity-assessment route, and a declaration of conformity before affixing CE marking.
The most useful preparation is to treat every requirement as an evidence question: what artefact proves it, who owns it, where is it stored, and how quickly can it be produced during an audit or customer review?
