EU Cyber Resilience Act explained for IoT/OT

FAQ

• What is the EU Cyber Resilience Act (CRA)?

  It’s an EU regulation setting cybersecurity requirements for products with digital elements sold in the EU to ensure they’re secure throughout their lifecycle.

• Who does the CRA apply to?

  Manufacturers, importers, and distributors of hardware and software products with digital elements in the EU market. Products that are already certified by security regulations in medical, automotive, aviation, defense or marine industry may be excluded.

• When will the CRA come into force?

  The EU Cyber Resilience Act’s vulnerability handling requirements will apply about 21 months after entry into force (~September 2026), while the essential cybersecurity requirements will apply after 36 months (~December 2027).

• Which products are covered by the CRA?

  Any product with digital elements, including IoT devices, software, and industrial systems, unless explicitly exempted.

• What are the key requirements of the CRA?

  Secure-by-design development, data security, vulnerability handling processes, security updates for at least the expected product lifecycle, and mandatory conformity assessments.

• Are there penalties for non-compliance?

  Yes. Fines can be up to €15 million or 2.5% of global annual turnover, whichever is higher.

• What is a “product with digital elements” under the CRA?

  Any hardware or software that processes digital data, including apps, connected devices, and industrial control systems.

• What is a conformity assessment?

  It’s a process to verify that a product meets CRA requirements, which can be self-assessment or involve third-party notified bodies, depending on risk.

• What should companies do to prepare for the CRA?

  Review product security practices, set up vulnerability management, ensure secure development, and plan for compliance testing and documentation.