Cyber Resilience Act: Core Requirements and Impact

On November 20, 2024, the Cyber Resilience Act (CRA) was published in the Official Journal of the European Union, introducing a uniform framework of mandatory cybersecurity requirements for products with digital elements. The CRA aims to strengthen the cybersecurity of hardware and software, across their lifecycle and throughout the supply chain, responding to the mounting risks from cyberattacks on the economy, democracy, consumer safety and health. 

This article explores the CRA’s scope of application, key requirements, affected parties, and its relationship with existing standards and EU legislation, in particular the NIS2 Directive (Directive 2022/2555) and the AI Act (Regulation 2024/1689). 

Scope of the Cyber Resilience Act

The CRA applies to products with digital elements that are connected to devices or networks, covering both hardware (Internet of Things, laptops, mobile phones, routers) and software (operating systems, games, password managers). The CRA applies across the full product lifecycle, from design to obsolescence. 

Cloud solutions are covered by the CRA only when they constitute remote data processing solutions. For instance, cloud-enabled smart home devices that allow users to control their devices remotely fall within the scope of the CRA.  

Open-source software falls under CRA compliance only when developed or supplied in the course of commercial activity (e.g., for paid technical support or monetisation). 

Specific exclusions also apply to products already regulated in existing EU laws, such as medical devices, in vitro diagnostic medical devices and motor vehicles. 

Overview of core requirements

The CRA’s essential requirements, provided in Annex I of the Regulation, apply to all products within its scope. Annex I is organised in two parts: Part 1 provides essential cybersecurity requirements that products must comply with; Part 2 provides vulnerability handling requirements that manufacturers must follow.  

In addition to this, the CRA adopts a risk-based approach in the classification of products which imply varying obligations for manufacturers, particularly regarding conformity assessment procedures.  

Depending on the cybersecurity risks and envisaged impact of an incident, the CRA classifies relevant products into the following categories: 

• Critical Products: These products are considered critical dependencies for NIS2 essential entities. Examples include hardware devices with security boxes, smart meter gateways, smartcards and similar devices, including secure elements. A list of Critical products can be found in Annex IV of the CRA. Critical products must undergo a strict conformity assessment, ideally achieving a European cybersecurity certificate when/if a certification scheme is available. If no such scheme is available manufacturers must follow the same procedures applicable to Important Class II products, involving third-party assessments. 

• Important Class II: These products perform, either functions critical to the cybersecurity of other products, networks or services, or functions that present a significant risk of compromising a high number of other products or the health and safety of users. Examples include hypervisors, firewalls, and tamper-resistant microprocessors. A list of Class II products can be found in Annex III of the CRA. Manufacturers of these products must complete a third-party conformity assessment. 

• Important Class I: These products perform the same functions of Class II products but would present lower cybersecurity risks if affected by cyber incidents. Examples include browsers, password managers, security information and event management (SIEM) systems, and smart home virtual assistants. A list of Class I products can be found in Annex III of the CRA. Manufacturers of these products can demonstrate their conformity by either completing a third-party assessment, or conforming to the harmonised standards to be drafted for the essential cybersecurity requirements set out in Annex I. 

• Default: This class is expected to cover the majority of products with digital elements. Manufacturers of these products can self-assess their compliance with the requirements of Annex I. 

Users’ expectations and compliance responsibilities

Under the CRA, users of digital products and connected devices can expect robust cybersecurity measures throughout the lifecycle of the products they purchase. These expectations stem from the compliance duties imposed on manufacturers, importers and distributors.  

Most comprehensive compliance duties are placed on manufacturers, ensuring that products demonstrate the following characteristics: 

• Cybersecurity is built in and considered from design to production. This includes manufacturers exercising due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product. 

• Ongoing risk management. Manufacturers must undertake an assessment of the cybersecurity risks associated with a product and take proactive steps to address any risks throughout the product lifecycle.  

• Free security updates for the support period (at least 5 years, unless a product is expected to be in use for a shorter period). Where applicable, manufacturers must provide these updates in an automatic manner. 

• Comprehensive documentation and instructions. Manufacturers must draw up the product technical documentation in accordance with the content requirements stated in Annex VII of the CRA, provide information and instructions to the user, and the EU declaration of conformity in line with content requirements set under Annex II and Annex V, respectively. 

Importers and distributors play a crucial role in maintaining the CRA’s standards by:  

• Verifying that products comply with the essential cybersecurity requirements and carry the CE marking, and making sure all required documentation is in place. 

• Withdrawing or recalling non-compliant products, and notifying the manufacturer and the relevant market surveillance authorities. 

Penalties for non-compliance

Non-compliance with the CRA can lead to significant penalties: 

1. Financial penalties:  

Higher Tier: Fines of up to €15 million or 2.5% of the global annual turnover for more severe breaches, such as failing to meet essential cybersecurity requirements.  

Lower Tier: Fines of up to €10 million or 2% of the global annual turnover for less severe infractions, such as breaching the obligations placed on importers and distributors.

2. Market restrictions and product recalls:

Authorities can prohibit, restrict or withdraw non-compliant products from the market.  

Interaction with other standards and EU legislation

As highlighted by the ENISA, no single industry standard, among those that are already in place, comprehensively covers all CRA requirements. Therefore, even if a certain product complies with a standard, such as ISO27001 (for example) there is still a need to check for potential gaps in relation to the CRA. 

As part of the EU Cybersecurity Strategy, the CRA is designed to align with other EU legislation, creating a cohesive regulatory environment that addresses both product security and organisational resilience.  

While the NIS2 Directive emphasizes strengthening the security posture of essential and important entities, the CRA shifts the focus to securing the cybersecurity of the products companies manufacture or sell. In this way, the CRA supports and facilitates compliance with the risk management obligations, especially with regard to supply chain, provided in the NIS2 Directive. The CRA ensures that the products used by essential and important entities are secure by design and throughout their lifecycle.  

Furthermore, the CRA and AI Act work together to ensured that AI-powered products comply with both cybersecurity and AI standards. Products with digital elements considered “high-risk” AI systems under the AI Act will be deemed compliant with its cybersecurity requirements if they meet the CRA’s requirements.  

Next steps for the implementation of the Cyber Resilience Act

The CRA will enter into force 20 days post-publication, i.e., 10 December 2024. Most provisions will become fully applicable three years after publication, while vulnerability reporting obligations will apply from 11 September 2026, i.e., 21 months thereafter. Chapter IV, regulating conformity assessment bodies, shall apply 18 months post-publication, i.e., 11 June 2026. 

Whilst ensuring compliance with the CRA may seem challenging, our data protection and cyber-risk service have extensive experience in navigating complex compliance requirements and in assisting organisations in adapting to evolving regulatory landscapes. Our expertise ensures that your organisation stays ahead of regulatory changes, fostering resilience and trust in a rapidly changing digital world. If you would like to discuss our services, please contact our advisors.