EU Cyber Resilience Act: 15 Key Requirements, Coverage, and Penalties

What Is the EU Cyber Resilience Act (CRA)? 

The EU Cyber Resilience Act (CRA) is a regulatory initiative aimed at enhancing cybersecurity across the European Union. It mandates that manufacturers ensure digital products and services meet security standards throughout their lifecycle. This act addresses the increased vulnerability of digital systems to cyber threats, supporting the EU’s broader goal of a secure digital single market.

The CRA imposes specific requirements on a wide range of digital products, from connected devices to software applications. Its core purpose is to limit cybersecurity risks by setting uniform rules for the design, development, and maintenance of these products. This regulation is intended to mitigate risks, boost consumer confidence, and foster a resilient digital economy across member states.

The CRA was introduced in 2020 and is expected to go into force in the second half of 2024. Most of its provisions will apply in full 36 months after publication, or 21 months for incident and vulnerability reporting.

Cyber Resilience Act Timeline 

Key milestones in the development and implementation of the EU Cyber Resilience Act (CRA) include:

• 2020: The CRA was introduced as part of the EU Cybersecurity Strategy.
• 2022: The CRA was officially proposed by the European Commission on 15 September, 2022.
• Second Half of 2024: The CRA is scheduled to enter into force. Thereafter, manufacturers and retailers must comply with the new cybersecurity requirements when bringing digital products to market. This includes adhering to harmonized rules for product development and ensuring proper cybersecurity measures are in place throughout the product lifecycle.
• By 2027: All products connected directly or indirectly to another device or network must bear the CE marking, indicating compliance with CRA standards. Manufacturers are required to ensure their products meet the cybersecurity obligations set out in the regulation before this deadline.
• Ongoing reviews: The European Commission will periodically review the CRA and report on its functioning to ensure it remains effective and relevant in addressing emerging cybersecurity threats. These reviews will help adapt the regulation to new technological advancements and cybersecurity challenges.

The CRA complements other EU legislation in the cybersecurity domain, such as the NIS2 framework, by setting a framework for cybersecurity requirements that cover the entire lifecycle of digital products. Its timeline ensures a phased implementation, allowing manufacturers and retailers sufficient time to comply, while progressively improving the EU cybersecurity landscape.

Who Is Impacted by the CRA? 

The EU Cyber Resilience Act (CRA) affects the entire supply chain of digital products, emphasizing the responsibilities of manufacturers, importers, and distributors. This regulation ensures that every stage of a product’s lifecycle is subjected to cybersecurity standards, from initial design to final distribution:

• Manufacturers are primarily accountable for ensuring that their products comply with CRA requirements. This includes those who perform substantial modifications to existing products. 
• Importers are also obliged to verify that products entering the EU market meet the prescribed cybersecurity standards. 
• Distributors, responsible for the circulation of these products within the EU, must ensure that the items they sell are compliant with the CRA.

By targeting the whole supply chain, the CRA aims to bolster consumer trust and enhance customer safety. The regulation applies to all relevant parties, regardless of where they are based, as long as the products are available in the EU market. This approach seeks to create a secure and resilient digital environment throughout the European Union.

15 Key Requirements of the EU Cyber Resilience Act

The EU Cyber Resilience Act (CRA) establishes several security requirements that manufacturers of digital products must adhere to. These requirements ensure that products are secure from the outset and throughout their lifecycle.

• Security by design and by default: Manufacturers must embed an appropriate level of cybersecurity into products from the beginning. Products should be placed on the market with a secure-by-default configuration. This includes the ability to reset products to their original state and settings that ensure security updates are installed automatically, with a user-friendly opt-out mechanism.

• Unauthorized access prevention: Appropriate control mechanisms, such as authentication, identity management, or access management systems, must be in place to prevent unauthorized access to products.

• Data protection: Confidentiality of stored, transmitted, or processed data must be protected. This can be achieved by encrypting relevant data both at rest and in transit using state-of-the-art mechanisms.

• Data integrity protection: Stored, transmitted, or processed data, commands, programs, and configurations must be protected against any manipulation or modification to ensure data integrity.

• Data minimization: Only data that is adequate, relevant, and limited to what is necessary for the intended purpose of the product should be processed. This principle helps in minimizing the amount of data handled by the product.

• Essential function availability: The availability of essential functions must be protected, ensuring resilience against and mitigation of denial-of-service attacks.

• Resilience against service attacks: Products must be designed to limit the potential entry points for cyberattacks, thereby minimizing the attack surface.

• Vulnerability management: Products must be placed on the market without any known exploitable vulnerabilities. Post-market vulnerabilities should be addressed promptly through security updates.

• Data portability: Users must be provided with an option to securely and easily remove all data and settings. Additionally, data should be transferable to other products or systems in a secure manner.

• New legal obligations for economic operators: The CRA imposes new legal obligations on manufacturers, importers, and distributors of digital products.

• Risk assessment: Manufacturers must ensure their products are designed, developed, and produced in accordance with the essential requirements by conducting thorough risk assessments at every stage of the product’s lifecycle.

• Continuous monitoring and free updates: Manufacturers are required to monitor their products throughout their expected lifecycle and provide free updates to address vulnerabilities. The support period for these updates must be at least five years, except for products with a shorter expected use period.

• Reporting: Manufacturers must report any actively exploited vulnerabilities and incidents to the competent national authorities within strict deadlines—24 hours for early warning and 72 hours for complete notification.

• Transparency: Manufacturers are required to produce technical documentation and user instructions in a clear and intelligible form. These instructions must be available in a language easily understood by users and market surveillance authorities.
• Importers and distributors: Importers and distributors must verify that manufacturers comply with the CRA requirements, including ensuring that products have the CE marking, which indicates compliance with CRA standards.

How Does the CRA Impact Organizations Outside the EU? 

The CRA is not only relevant for manufacturers based in the EU, but also has direct and indirect impact on manufacturers outside the EU.

Direct Impact

Products sold in the EU

Non-EU companies intending to sell products with digital elements in the EU must comply with the CRA’s requirements. This includes performing risk assessments, promptly reporting vulnerabilities, and potentially undergoing conformity assessments to ensure their products meet EU standards. Failure to adhere to these requirements can result in substantial fines or even bans from the EU market, thereby enforcing high compliance levels.

Supply chains

Non-EU companies that supply components or software for digital products destined for the EU market must also align their practices with the CRA. This means they need to ensure their products meet the necessary cybersecurity standards, even if they do not directly sell their products in the EU. Non-compliance can disrupt supply chains, as EU-based manufacturers will require certified components to comply with the CRA.

Indirect Impacts

Market pressure

The CRA sets a high benchmark for cybersecurity within the EU. This regulatory framework pressures non-EU companies to elevate their cybersecurity standards to remain competitive. Companies within the EU market will inherently comply with these standards, creating an environment where non-compliant entities may find themselves at a disadvantage.

Tech harmonization

The principles and regulatory approaches of the CRA may influence other regions to adopt similar cybersecurity standards. This could lead to a more harmonized global cybersecurity landscape, facilitating smoother international trade and compliance processes. As a result, non-EU companies might find it beneficial to align with CRA standards in anticipation of similar regulations being adopted worldwide.

Business reputation

Adhering to the CRA can enhance a company’s reputation for prioritizing cybersecurity. Non-EU companies that demonstrate high cybersecurity standards can gain a competitive edge, fostering trust among consumers and business partners. This improved reputation can positively impact market share and business opportunities, emphasizing the importance of compliance even for companies outside the EU.

Related content: Read our guide to EU MDR

Consequences of Noncompliance with the CRA 

Noncompliance with the EU Cyber Resilience Act (CRA) carries significant repercussions for businesses. The regulation establishes enforcement mechanisms and penalties to ensure adherence to its cybersecurity standards.

Market Surveillance

Each EU Member State will appoint one or more market surveillance authorities to enforce the CRA at the national level. These authorities will monitor compliance, conduct inspections, and take necessary enforcement actions. For digital products classified as “high-risk AI systems” under the AI Act, the same national market surveillance authority will oversee compliance with both the CRA and the AI Act.

An Administrative Cooperation Group (ADCO) will be established at the EU level, consisting of representatives from all national market surveillance authorities and the European Commission. This group will ensure uniform application of the CRA across the EU, facilitating cooperation and coordination among member states.

Sanctions

The CRA introduces a sanctions regime for noncompliance, with potential fines ranging from €5 to €15 million or 1% to 2.5% of global annual turnover, whichever is higher. The severity of the fines is based on the nature of the breach:

• Breach of essential requirements: This category incurs the highest fines.
• Breach of other requirements: Noncompliance with other aspects of the CRA will result in lower, but still substantial, fines.
• Failure to provide accurate information: Companies that fail to submit accurate and complete information to authorities can also face fines.

Additionally, if noncompliance with the CRA leads to a personal data breach, it is currently unclear whether fines will be imposed under both the GDPR, the CRA, or both.

Best Practices to Prepare for the Cyber Resilience Act 

To effectively comply with the EU Cyber Resilience Act (CRA), organizations must integrate cybersecurity measures and adopt proactive strategies. Here are some best practices:

1. Understand the Requirements

This includes reviewing the technical requirements and obligations that apply to your specific products or services. The CRA mandates specific cybersecurity standards at each stage of a product’s lifecycle, from initial design to post-market surveillance. Organizations should identify which aspects of the CRA apply directly to their business model, particularly if they manufacture, import, or distribute digital products within the EU market. 

Consulting with legal or regulatory experts can provide clarity on the finer details of compliance, such as understanding the implications of CE marking, incident reporting obligations, and the penalties associated with noncompliance. In-depth knowledge of the CRA enables companies to tailor their internal policies and processes to meet the regulation’s requirements effectively.

2. Conduct Thorough Risk Assessments

Performing regular and detailed risk assessments is critical to identifying potential cybersecurity threats that could affect your digital products. Under the CRA, manufacturers are required to assess risks not only during product development but throughout the product’s entire lifecycle. This involves evaluating both the internal vulnerabilities (e.g., weak code, insecure configurations) and external threats (e.g., emerging malware, attack vectors) that could compromise product security. 

A systematic risk assessment framework, such as those based on ISO/IEC 27001 or NIST guidelines, can help organizations assess threats in a structured way. These frameworks guide companies in categorizing risks, defining their potential impact, and prioritizing mitigation efforts. Documentation of these assessments should be updated regularly and provided to market surveillance authorities upon request. 

The risk assessment process should also consider the supply chain, ensuring that third-party components or software meet the necessary cybersecurity standards to avoid supply chain disruptions.

3. Implement Security-by-Design

The concept of “security-by-design” means integrating robust cybersecurity features from the very beginning of the product development process, rather than retrofitting security features later. This proactive approach is essential for compliance with the CRA, which requires that products be secure by default before they are placed on the market. 

Security-by-design involves several key principles: minimizing attack surfaces, implementing secure default configurations, and ensuring that security updates can be applied efficiently. For example, developers should prioritize secure coding practices to prevent vulnerabilities such as buffer overflows or SQL injection attacks. 

Additionally, products should feature automatic update mechanisms to quickly patch security flaws without requiring complex actions from end users. Security-by-design also extends to physical device security, including tamper resistance and secure boot processes.

4. Perform Regular Compliance Checks

Maintaining compliance with the CRA is an ongoing process, requiring regular checks to ensure that all cybersecurity measures remain up to date and effective. Compliance audits, both internal and external, should be conducted at key stages of the product life cycle, including after major software updates or the release of new features. These audits ensure that no known vulnerabilities are present and that products still meet the essential security requirements set out in the CRA. 

Regular compliance checks should also involve reviewing the cybersecurity posture of third-party suppliers and vendors, as any noncompliance on their part could impact the security of the final product. For example, a software component sourced from an external developer must adhere to the same CRA cybersecurity standards. In addition to technical audits, administrative tasks such as updating technical documentation and ensuring CE marking for all products are necessary to demonstrate compliance during inspections.

5. Stay Informed about Changes

The CRA is designed to evolve over time, with periodic reviews conducted by the European Commission to ensure it remains effective in addressing emerging cybersecurity threats. As technology advances and new threats emerge, the CRA will likely be updated to reflect the changing cybersecurity landscape. Organizations need to stay informed about these updates to avoid falling out of compliance. 

This requires monitoring communications from EU regulatory bodies, participating in industry conferences, or subscribing to relevant updates from cybersecurity agencies. Keeping your compliance team up to date on regulatory changes will allow your organization to anticipate adjustments and proactively implement necessary changes.

6. Build a Compliance Toolkit

Developing a compliance toolkit can greatly simplify the ongoing process of meeting CRA requirements. This toolkit should include a range of resources such as templates, checklists, and automated tools designed to ensure consistent adherence to the regulation. For instance, a checklist might cover critical elements such as conducting a thorough risk assessment, verifying product documentation, and confirming the application of security updates. 

Automated tools for vulnerability management, incident reporting, and product testing can save time and reduce the risk of human error. Additionally, tools that help monitor third-party software components for known vulnerabilities are invaluable for organizations relying on external suppliers. By standardizing compliance tasks and integrating them into daily workflows, organizations can streamline their approach to maintaining cybersecurity standards and reduce the risk of oversight.

7. Focus on Long-Term Planning

Long-term planning is crucial to sustaining compliance with the CRA over the lifecycle of a digital product. Compliance does not end once a product is launched; rather, it requires ongoing support, including continuous monitoring for vulnerabilities and timely distribution of security updates. Companies should develop long-term strategies to maintain cybersecurity measures, including setting aside resources for product updates and establishing incident response protocols for dealing with breaches. 

One key aspect of long-term planning is ensuring that all products have at least five years of post-market support, during which time they must receive free security updates, as mandated by the CRA. For products with shorter lifespans, organizations must be clear about the duration of their support.

8.Invest in Training and Mentorship

A critical element of CRA compliance is ensuring that all relevant personnel are educated about the regulation’s requirements and cybersecurity best practices. This includes not only the technical staff responsible for product development but also employees in compliance, legal, and risk management roles. 

Regular training sessions should be held to keep staff informed of any updates to the CRA, as well as emerging cybersecurity threats and new technologies. Mentorship programs can help newer or less experienced employees develop a deeper understanding of cybersecurity practices. Pairing them with seasoned cybersecurity professionals can facilitate knowledge transfer and strengthen the organization’s overall ability to meet CRA requirements.

How can Sternum help?

Sternum’s patented EIV software technologies provides medical device manufacturers real-time security controls to mitigate exploitations of a wide array of minor and major vulnerabilities. 

Avoid approval delays from missing key cybersecurity mitigations for low risk vulnerabilities, learn more about Sternum for IoT security and visit our regulation learning center.