The Cyber Resilience Act

Nowadays, almost every digital device and digital application contains software and connectivity. From smartwatches to connected refrigerators, from business software to a smart thermostat – digital products are used everywhere in our daily lives. However, these products often constitute weak points in cybersecurity: security measures are often subordinate in the development process, resulting in vulnerabilities and outdated security practices (think of default passwords or lax update support). This creates unnecessary risks of cyber incidents, data breaches and economic damage.

Regulation (EU) 2024/2847, better known as the Cyber Resilience Act (hereinafter the ‘CRA’), addresses this issue as a product-regulating instrument and thus forms part of the broader EU Digital Strategy. For the first time, this new EU regulation imposes harmonised cybersecurity obligations on manufacturers of digital products in the EU. The aim of the regulation is to guarantee a basic level of cybersecurity by making products safer from the design stage onwards (‘security by design’) and keeping them up to date and resilient throughout their entire lifecycle (‘security by default’ and ‘lifecycle vulnerability management’).

1. The CRA: what does it cover and who is responsible?

The CRA applies to ‘products with digital elements’, i.e. software and hardware that are directly or indirectly connected to a network or another device. Smart devices and software applications therefore generally fall under the regulation. Think, for example, of a smart refrigerator or thermostat, a baby monitor with an app, a laptop or phone, a web browser or mobile application, etc. Even hardware components and software modules that are placed on the market separately (such as individual computer components or libraries) can be ‘products with digital elements’. Cloud services that are essential for the operation of a product are also covered by these rules (so-called ‘remote data processing’). The CRA also explicitly excludes certain situations from its scope (e.g. spare parts to replace identical components and prototypes presented at a trade fair with a clear indication of non-compliance).

The CRA imposes obligations on all market operators that play a role in making ‘products with digital elements’ available on the EU market, in particular manufacturers, who are subject to the bulk of the obligations, and importers and distributors, whose role is to ensure that only compliant products with digital elements are distributed. Important note: if an importer or distributor sells a product under its own name or substantially modifies it (e.g. distributes it under its own brand or adds its own software), the CRA considers that party to be the manufacturer, with all additional obligations.

2. What are the core principles and key deadlines of the CRA?

We can derive a few core principles from the provisions of the CRA, which together aim to ensure the cyber resilience of products with digital elements within the European Union:

1. Security by design and by default settings: ensuring an appropriate level of cybersecurity for products with digital elements from their design stage and throughout their entire lifecycle, as well as always providing the most secure default settings;
2. Maintenance and updates throughout the lifecycle: manufacturers must determine the support period for each product and communicate this to the customer in a transparent manner (e.g. in the manual or via digital means). This should enable users to make a more informed decision when purchasing a product with digital elements;
3. Reporting obligation: by analogy with the reporting obligations under the NIS2 regulations, manufacturers must report vulnerabilities and cyber incidents with a significant impact to the supervisory authorities based on a cascade system of deadlines;
4. Conformity and documentation: manufacturers of products with digital elements that are ‘important’ or ‘critical’ are subject to additional conformity and documentation obligations in line with other product regulations.

The CRA rules are becoming applicable in phases from the date of entry into force on 10 December 2024. The key deadlines are 11 September 2026 for the applicability of the reporting obligations, and 11 December 2027, when all obligations under the CRA become applicable.

3. How can you best prepare?

For organisations acting as manufacturers, the new rules will have an impact on their business processes and product development. However, this is also an opportunity: by already taking into account the CRA, your organisation can build customer trust and differentiate itself in the market. Below we list some action points and recommendations to help your organisation prepare appropriately for the CRA:

• Analyse whether your organisation falls under the CRA: determine whether the hardware and/or software that your organisation develops, (re)sells or imports falls under the definition of ‘product with digital elements’, or whether it specifically falls under an exception;
• Verify whether your product qualifies as ‘important’ or ‘critical’: in addition to the security measures that manufacturers must take for all ‘products with digital content’, specific obligations also apply to ‘important’ and ‘critical’ ‘products with digital elements’;
• Establish a compliance roadmap: the transition period until the end of 2027 to ensure compliance with the CRA may seem long, but compliance requires a timely and structured approach. Determine which steps your organisation needs to take (from analysing obligations and implementing security measures to obtaining any required certifications, etc.) and schedule the required steps over time;
• Integrate ‘security by design’ and ‘security by default’ into the product: assess whether your current development and implementation processes comply with these principles, i.e. your organisation must ensure that the products meet the cybersecurity requirements before the products are offered, and the product’s default settings must be as cyber-secure as possible throughout the entire lifecycle of the products;
• Implement vulnerability management: your organisation must provide software updates and patches for identified vulnerabilities in a timely manner. Also establish a policy for security research and vulnerability reporting, so that both internal teams and external researchers can easily report problems and you can respond quickly;
• Consult with suppliers: map out the external components or open-source software contained in your products. Ask suppliers about their security practices and update schedules, and establish in their contracts that they must provide patches and information in a timely manner. This way, you safeguard the end-to-end security of your product.

Conclusion

The CRA is an important development within the EU Digital Strategy, with an impact on a large number of companies and organisations. The regulation creates a level playing field in terms of cybersecurity for all players bringing digital products to market, and serves to strengthen trust in technology. Organisations that proactively invest in secure products and put their compliance in order in the coming years will not only avoid fines and reputational damage, but can also differentiate themselves in a market that will increasingly select for security and reliability. Timely preparation is therefore essential for your company.