The EU's Cyber Resilience Act (CRA) is the result of a lengthy political and regulatory process aimed at improving cybersecurity in the internal market – not only for critical sectors or large companies, but for all digital products and software solutions sold in the EU. With the CRA, the Commission has sought to establish a common and binding framework for cybersecurity that must be embedded from the outset in the design, development, and maintenance of digital products, whether physical or purely software-based.

CRA as a legal requirement: The CRA initiative was initially announced as part of the EU's Cybersecurity Strategy for the Digital Decade, launched in December 2020. This strategy highlighted the lack of regulation of the enormous amount of hardware and software that currently forms the backbone of the digital society – especially outside the sectors already covered by, for example, the NIS directives. 

The safety of these products was largely left to the market, which led to significant variations in quality and responsibility. The CRA was intended to rectify this and create a basic level of safety for all digital products throughout the EU.

The Commission presented its proposal for a regulation on September 15, 2022, and it quickly became the subject of intense negotiations between the European Parliament, the Council, and the Member States. The political focus has largely been on striking a balance between, on the one hand, high cybersecurity requirements and, on the other hand, not stifling innovation – especially among small and medium-sized enterprises, which are often behind new digital solutions. 

Following trilogue negotiations, the CRA was finally adopted in April 2024 and published in the Official Journal of the European Union on May 27, 2024. It thus formally entered into force 20 days later, in June 2024. However, as with many EU regulations, its actual application has been postponed to give companies time to adapt. 

For companies that develop software themselves, there are specific requirements that must be met to ensure a robust and secure development process. These requirements are not merely theoretical—they provide practical guidance for avoiding serious security breaches and meeting both regulatory and customer-driven expectations.

The Cyber Resilience Act (CRA) implements new EU cybersecurity rules that ensure more cyber-resistant hardware and software on the European market.
From baby monitors to smart watches, products and software containing a digital component have become an important part of our daily lives.

However, not many users of such devices are concerned about the security risks that such products and software may pose. The problem addressed by the proposed regulation is twofold. Firstly, there is the inadequate level of cybersecurity inherent in many products, or inadequate security updates for such products and software.

The CRA is a regulation, not a directive. This means that it applies directly in all EU Member States without having to be implemented into national law. Its actual application and enforcement will therefore come into force in December 2027, 36 months after the publication of the regulation.

During this transition period, manufacturers, importers, and distributors must ensure that their products and processes comply with the requirements. In addition, there are special transitional arrangements for products already on the market and for software that is continuously updated.

The CRA also contains provisions on security updates, vulnerability management, risk assessment, and documentation, which means that companies must establish processes similar to those familiar from, for example, ISO 27001 or ENISA's guidelines.

At the same time, it is expected that a number of harmonized standards will be developed during the period leading up to the entry into force in 2027. These standards will be key tools for manufacturers who want to demonstrate compliance with CRA requirements—and thus be allowed to market their products in the EU.

When the proposed regulation enters into force, software and products connected to the internet will bear the CE mark to indicate that they comply with the new standards. By requiring manufacturers and retailers to prioritize cybersecurity, customers and businesses will be empowered to make more informed choices, trusting the cybersecurity information provided for CE-marked products.

The new regulation will supplement existing legislation, specifically the NIS2 framework. It will apply to all products that are directly or indirectly connected to another device or network, with specified exceptions such as open source software or services already covered by existing rules, which is the case for medical devices, aviation, and cars.

With the CRA, the EU is taking a historic step towards making cybersecurity an integral part of the digital single market. The regulation is a direct consequence of the many security breaches, vulnerabilities and critical incidents that have characterised recent years – from log4j[1] to vulnerable IoT devices and opaque software supply chains. 

The CRA enshrines the principle that security must not be an afterthought, but must be a fundamental condition for access to the EU market. At the same time, it ensures a uniform level of cybersecurity throughout the Union, which is particularly important for consumers and small businesses that would otherwise be left unprotected in a highly technical and fragmented market.

[1] Log4j is a widely used open source Java logging library developed by the Apache Software Foundation. It is a core component of many applications and frameworks, allowing developers to track and record events in their software.

A critical vulnerability, known as Log4Shell (CVE-2021-44228), was discovered in December 2021 and affected versions 2.0-beta9 through 2.14.1. This vulnerability enabled remote code execution, meaning attackers could potentially gain control of affected systems by exploiting the flaw.