As of today, 10 December 2024, the Cyber ​​Resilience Act (CRA) has officially entered into force. This law is aimed at manufacturers, distributors and importers of hardware and software that will be placed on the market in the EU from 11 December 2027.

 

The aim of the CRA is to ensure that digital products and services placed on the EU market meet minimum cybersecurity requirements throughout their lifecycle.

The CRA requires them to ensure that digital products meet essential security requirements. They must also provide security updates to ensure that products remain secure. This way, consumers and businesses can be confident that products they have purchased in the EU are digitally secure.

The CRA sets requirements for the products that suppliers bring to the market, but also for the processes that manufacturers have set up to develop, design, manufacture and maintain their products. For example, the supplier must perform risk analyses that form the basis for a secure design. In the event of serious incidents or actively exploited vulnerabilities, the supplier will be obliged as of 11 September 2026 to report to the national CSIRT (in the Netherlands the National Cyber ​​Security Centre, NCSC) and to inform and advise the affected users.

With the CRA coming into effect, the official guidelines and timelines have now been established. The CRA went into effect on December 10, but manufacturers do not have to comply with all the requirements immediately. A major milestone will be reached in September 2026 with the introduction of a reporting requirement, followed by full CRA compliance in December 2027. (Digital Trust Center)

Technology