CRA

The Cyber Resilience Act sets cybersecurity requirements for hardware and software products sold in the EU, across their whole life. Manufacturers must design products securely, handle vulnerabilities, supply security updates for a defined support period, and report actively exploited vulnerabilities and severe incidents.

It is the first EU law to make "secure by design" a condition of market access for almost every connected product and most commercial software, and it brings CE marking to cybersecurity.

• Products with digital elements: hardware and software, including remote data processing solutions integral to them, whose intended or foreseeable use includes a connection to a device or network, placed on the EU market.
• Manufacturers carry most duties; importers and distributors must check products comply.
• Important and critical products, such as identity management software, password managers, VPNs, operating systems, firewalls and smart cards, face stricter conformity assessment.
• Excluded: products covered by their own sector rules (medical devices, cars, aviation, marine equipment), products solely for national security or defense, and free and open-source software not supplied in the course of a commercial activity. Open-source stewards have a lighter regime.

Users must receive clear information on the product's support period, security updates and how to report vulnerabilities, and can complain to market surveillance authorities.

Jusqu’à €15 millions ou 2.5% du chiffre d’affaires annuel mondial, le montant le plus élevé étant retenu, en cas de non-respect des exigences essentielles de cybersécurité ou des principales obligations des fabricants ; jusqu’à €10 millions ou 2% pour les autres obligations ; jusqu’à €5 millions ou 1% pour la fourniture d’informations inexactes ou trompeuses (art. 64). Les autorités peuvent également ordonner le retrait ou le rappel de produits.

1. Inventory your products with digital elements sold in the EU and classify each: default, important (Class I or II) or critical.
2. Stand up reporting now: 24-hour early warning, 72-hour notification and final reports for exploited vulnerabilities and severe incidents.
3. Set a support period for each product and plan security updates for it.
4. Build a vulnerability handling process, including a coordinated disclosure policy and a software bill of materials.
5. Gap-assess designs against the Annex I essential requirements before December 2027.
6. Check your open-source components and the due diligence you do on them.