First of its Kind: Cyber Resilience Act

The Cyber Resilience Act (CRA), which aims to harmonize the cybersecurity requirements of digital products between the member states of the European Union and ensure that these products comply with cybersecurity standards, was published in the EU Official Journal on 20 November 2024.

In a world where cyber-attacks are on the rise, with reports predicting that an attack will occur every 2 seconds by 2031 and that this may cause an annual cost of more than € 251 billion^[1] , this law will make a big name for itself.

Surely, cyber security-oriented regulations in the EU, such as the Cyber Security Law, Directive Network and Information Security Directive (NIS2) should not be disregarded.

Although the law will generally come into effect on 11 December 2027, certain provisions will apply earlier.

Definition and Scope of the EU Cyber Resilience Act

The first EU-wide CRA aims to establish a single set of rules for the whole EU, covering all software and hardware products, including data processing systems and components for sale separately.

The CRA aims to ensure that products with digital components are safe throughout their lifecycle, covering manufacturers, software developers, importers, distributors and resellers. It would be appropriate to say that the CRA focuses primarily on companies that develop and market non-embedded software.

All products that are directly or indirectly connected to the network, such as Internet of Things (IoT) devices, operating systems and high-risk artificial intelligence systems, are covered by the law. However, there are of course some exceptions to the scope:

▪️ Devices already covered by other EU rules (NIS2 Directive, AI Act, etc.)

▪️ Software as a service (SaaS) that is not a core component of the product. Some products are excluded, such as free open-source software, which is used for research and innovation and is not for profit.

However, it should be emphasized that open-source software from which developers derive some form of commercial activity is included.

The CRA divides products into two main categories according to their level of importance as important and critical:

▪️ Important products: Products are considered “important” if they provide critical functions for cybersecurity or can adversely affect user and product security through manipulation. Examples include products that contain digital elements and provide critical functions for cyber security such as identity management, VPN, operating systems.

▪️ Critical products: Critical products are defined according to the risk that vulnerabilities could cause serious disruptions in the supply chain. Examples include hardware devices with security boxes, smart meter gateways and smart cards.

We have compiled the prominent regulations in the CRA for you below:

Basic Requirements: CRA sets out the basic requirements to ensure the cyber security of digital products. Products must be designed, developed and manufactured to address risks. These basic requirements include eliminating security vulnerabilities, offering default security configurations, providing timely security updates, and protecting data confidentiality, integrity, and availability.

Key Requirements Imposed on Manufacturers: Manufacturers must provide a control mechanism against unauthorized access, limit data collection to only what is necessary, and ensure resilience against potential attacks. In addition, manufacturers are required to test product security on a regular basis and immediately identify and fix security vulnerabilities.

▪️ Product lifecycle security: Manufacturers should ensure cybersecurity at all stages of the product (design, production, updates), remediate vulnerabilities and offer default security settings.

▪️ Product conformity assessments: All products must undergo security checks before they can be sold on the EU market, and products that pass the checks must be CE marked, which is required before they can be sold in the EU.

▪️ Vulnerability reporting: Manufacturers are required to provide a method for reporting vulnerabilities or receiving such reports. Manufacturers must report actively exploited vulnerabilities within 24 hours and provide a more detailed report after 72 hours.

▪️ Third-party component integration: If manufacturers use components or software produced by others, including open-source components, they must secure them, document vulnerabilities, and report the person or organisation that produced or maintains the vulnerable component.

What will be the Enforcement Sanctions?

In case of non-fulfilment of the CRA rules, the highest of the following amounts will be imposed as a fine:

• Cyber security breaches: up to €15,000,000 or 2.5 per cent of annual sales

• Other infringements: Up to €10,000,000 or 2% of annual sales

• Providing incorrect information: Up to €5,000,000 or 1% of annual sales

Table on the Application Date of the CRA:

The full text of the CRA is available here (only available in EU languages).