EU Cyber Resilience Act (EU CRA). Customer Statement

The EU Cyber Resilience Act (EU CRA) is designed to enhance the security of digital products, including software and connected devices. The Act establishes clear and consistent rules for companies to follow when making these products. This mandatory regulation reduces risks by requiring manufacturers to embed security in their products and promptly resolve any cybersecurity vulnerabilities identified in the field. The goal is to create a safer digital environment for everyone by encouraging the availability of "secure by default" products. The EU CRA requires manufacturers to place compliant products on the European Union market starting December 11, 2027. Manufacturers are also obligated to report severe incidents and actively exploited vulnerabilities to the relevant national authorities or Computer Security Incident Response Teams (CSIRTs) starting September 11, 2026.

The EU CRA mandates that Products with Digital Elements (PDEs) which connect or interact with other devices or networks must meet essential cybersecurity requirements in their design, development, and production. The Act also requires vulnerability management throughout the product life cycle. The description below provides an overview of the key obligations under the EU CR.

The EU CRA categorizes PDEs into four groups with varying conformity assessment levels: "Common," "Important Class I," "Important Class II," and "Critical." "Important" and "Critical" PDEs are listed in Annexes III and IV. "Important" PDEs (e.g., firewalls) and "Critical" PDEs (e.g., Hardware Security Module, Smartcards) provide key cybersecurity functions or are essential for key entities or supply chains in the EU. They require compliance with harmonized standards and third-party certification.

Products are listed under Annexes III or IV only if their core functions correspond to the specified types; combined products, such as Machinery, do not inherit the criticality classification. Despite differences in conformity assessments, the fundamental cybersecurity requirements for product characteristics remain consistent across all categories.