Cyber Resilience Act Time to Get Your Digital Products Compliant.

The CRA was created to address two main problems: the low level of security in many digital products (widespread vulnerabilities, absent or inconsistent security updates) and the lack of information available to users and companies to evaluate the security of the products they purchase. A single compromised device can propagate an attack across an entire organization or supply chain: that is why the EU introduced common minimum requirements, valid across the internal market.

Manufacturers, importers, and distributors of products with digital elements placed on the European Union market must comply with the CRA. This generally includes: those who sell software as a product (with the cloud functions it depends on), those who manufacture connected devices or IoT, and those who supply software or hardware components integrable by third parties. The CRA applies to both B2B and B2C contexts. SMEs are also involved, although they can benefit from support tools and simplified procedures provided by the regulation.

Some products with digital elements are excluded because they are already regulated by more specific or stricter sector regulations, for example: medical devices and in vitro diagnostics regulated by dedicated rules, motor vehicles subject to type-approval, certified aeronautical products and marine equipment, products developed exclusively for defense or national security, spare parts identical to already compliant components. This is why it is important to carefully analyze your catalog, evaluating both product categories and regulations already applicable in the sector.

The CRA (Article 64) sets fines of up to 15 million euros or 2.5% of worldwide annual turnover, whichever is higher, for failing to meet the essential cybersecurity requirements or the vulnerability handling and reporting obligations. Other obligations carry up to 10 million euros or 2%, and incorrect or incomplete information to the authorities up to 5 million or 1%. Market surveillance authorities can also impose corrective measures such as the withdrawal or recall of non-compliant products and a ban or restriction on making them available on the market.

The CRA applies to products with digital elements placed on the market from December 11, 2027. The date applies to each individual unit: a model already in your catalog that you keep selling after that date must comply. A unit placed on the market before that date is in scope only if it undergoes a substantial modification afterwards. The exception is the obligation to report exploited vulnerabilities and severe incidents, which since September 11, 2026 also applies to products already on the market. Therefore, if you have legacy products still on sale or under maintenance, it is advisable to evaluate in advance whether and how to bring them to a security level compatible with the CRA.

As a rule, no: SaaS and cloud services fall under the NIS2 directive, not the CRA. The CRA covers them only when they are the remote data processing solution of a product with digital elements, that is, software designed by the manufacturer, or under its responsibility, without which the product cannot perform one of its functions. One example is the cloud service that lets you control a smart home device remotely. To know whether your cloud solutions are in scope, analyze the link between the service and the products you sell.

It means integrating cybersecurity into all phases of the product lifecycle: risk analysis and security requirements definition already at the design phase, secure development with automated controls (code review, static/dynamic analysis, dependency scanning), vulnerability management throughout the product’s life, planning security updates and guaranteed minimum support, and runtime monitoring to detect and manage incidents. In practice, it means adopting a true Secure SDLC supported by DevSecOps practices. For most products, conformity is shown through the manufacturer’s self-assessment. Important products of class I can use it only if they apply harmonized standards, common specifications or certification schemes; class II products require a third-party body; for critical products the Commission can require a European cybersecurity certificate.

The CRA does not prohibit the use of third-party components or open source software, but requires them to be managed consciously. This means: maintaining an up-to-date inventory of dependencies (SBOM), monitoring known vulnerabilities of used components, defining clear update, replacement, and deprecation policies, and evaluating the impact of components on the entire product security architecture. The software supply chain becomes an integral part of the conformity assessment.

The European security regulatory landscape is evolving on multiple fronts: the CRA focuses on the security of products with digital elements (hardware and software), the NIS2 directive aims at the resilience of operators, infrastructures, and essential services, the AI Act regulates artificial intelligence systems (particularly high-risk ones) to ensure safety and protection of fundamental rights. Many organizations may be subject to more than one of these regulations. It pays to address them together, to build a coherent security strategy across the entire supply chain.