Cyber Resilience Act: Time to Get Your Digital Products Compliant

The CRA was created to address two main problems: the low level of security in many digital products (widespread vulnerabilities, absent or inconsistent security updates) and the lack of information available to users and companies to evaluate the security of the products they purchase. In a context where a single compromised device can propagate an attack across an entire organization or supply chain, the EU chose to introduce common minimum requirements, valid across the internal market.

Manufacturers, importers, and distributors of products with digital elements placed on the European Union market must comply with the CRA. This generally includes: those who sell software as a product or service (including many SaaS models), those who manufacture connected devices or IoT, and those who supply software or hardware components integrable by third parties. The CRA applies to both B2B and B2C contexts. SMEs are also involved, although they can benefit from support tools and simplified procedures provided by the regulation.

Some products with digital elements are excluded because they are already regulated by more specific or stricter sector regulations, for example: certain medical devices regulated by dedicated standards, automotive sector products, aviation or maritime equipment, products developed exclusively for defense or national security, spare parts identical to already compliant components. This is why it is important to carefully analyze your catalog, evaluating both product categories and regulations already applicable in the sector.

The CRA introduces a significant penalty regime. The most serious violations can result in fines of up to millions of euros or a percentage of the economic operator's global annual turnover. National authorities can also impose corrective measures such as: withdrawal or recall of non-compliant products, market placement bans, obligation to report exploited vulnerabilities or security incidents within very tight deadlines.

The CRA applies to products with digital elements placed on the market after the deadlines set by the regulation. However, if you continue to sell or update existing products beyond those dates, you will still need to consider their compliance. The difference is between legacy products that are no longer on the market and products still actively marketed or supported. Therefore, if you have legacy products still on sale or under maintenance, it is advisable to evaluate in advance whether and how to bring them to a security level compatible with the CRA.

Yes, in many cases. The CRA does not only concern hardware or physical devices: numerous SaaS services and cloud platforms fall within scope when offered as products with digital elements on the EU market. You need to evaluate the business model (license, subscription, managed service), the method by which the product is made available to users, and the type of connection to the customer's systems. Analyzing the delivery model and technical perimeter is a key step in understanding if and how the CRA applies to your cloud solutions.

It means integrating cybersecurity into all phases of the product lifecycle: risk analysis and security requirements definition already at the design phase, secure development with automated controls (code review, static/dynamic analysis, dependency scanning), vulnerability management throughout the product's life, planning security updates and guaranteed minimum support, and runtime monitoring to detect and manage incidents. In practice, it means adopting a true Secure SDLC supported by DevSecOps practices.

The CRA does not prohibit the use of third-party components or open source software, but requires them to be managed consciously. This means: maintaining an up-to-date inventory of dependencies (SBOM), monitoring known vulnerabilities of used components, defining clear update, replacement, and deprecation policies, and evaluating the impact of components on the entire product security architecture. The software supply chain becomes an integral part of the conformity assessment.

The European security regulatory landscape is evolving on multiple fronts: the CRA focuses on the security of products with digital elements (hardware and software), the NIS2 directive aims at the resilience of operators, infrastructures, and essential services, the AI Act regulates artificial intelligence systems (particularly high-risk ones) to ensure safety and protection of fundamental rights. Many organizations may be subject to more than one of these regulations. Seeing them as complementary is essential for building a coherent security strategy across the entire supply chain.