The EU Cyber Resilience Act (CRA) is a legislative proposal introduced by the European Commission to improve the security of digital products and services across the European Union (EU). The Act aims to set cybersecurity standards for connected devices and software, ensuring that manufacturers, developers, and distributors take responsibility for the safety of their products throughout their life cycle.
This blog post answers frequently asked questions about the CRA.
The CRA mandates that digital products be secure by design and by default, meaning that cybersecurity must be built into a product’s development and implementation from the start.
Manufacturers must ensure that products remain secure over time, providing timely updates to fix vulnerabilities as they emerge. In addition, products must undergo security assessments to verify compliance with cybersecurity standards before being launched on the market.
The Act applies to manufacturers of products with digital elements, including hardware (e.g., smart devices) and software (e.g., operating systems and applications). It covers products sold within the EU, whether they are manufactured in the EU or imported from other regions. Although the CRA is an EU regulation, many expect it to have significant global impact since companies that want to sell digital products in the EU market must comply with the Act’s standards.
The scope of the Act includes:
The CRA was officially adopted on October 10, 2024 and the regulation entered into force two months later on December 10. Below are other key dates:
The EU CRA draws heavily on principles from the following frameworks in mandating secure design, lifecycle security, and accountability:
Manufacturers are primarily responsible for ensuring that their products meet the relevant security requirements, conducting risk assessments, and fixing vulnerabilities. Distributors and importers must ensure that the products they handle comply with the CRA.
Products that pose a security risk have to be withdrawn from the market, and responsible parties must inform customers of any vulnerabilities and fixes.
Companies must implement vulnerability handling procedures and provide security updates for their products. They must also report any actively exploited vulnerabilities or incidents to the EU cybersecurity agency, ENISA, within 24 hours of discovery.
The CRA imposes significant fines for non-compliance, with penalties reaching up to €15 million or 2.5% of the global annual turnover, whichever is higher.
The first consideration is lifecycle security. The act ensures that products are secure throughout their lifecycle, from production and distribution to use and disposal. This includes continuous security monitoring and patching to address emerging threats.
The second consideration is support for consumers. The CRA aims to empower consumers by providing more transparency around the security features of digital products. Manufacturers must clearly communicate security related information, such as the expected lifespan of updates, to buyers.
For manufacturers and developers, the CRA places the burden of cybersecurity on product creators, requiring them to proactively ensure security and continuously update their products. This will likely increase compliance costs; however, it will also enhance product reliability and customer trust.
For consumers, buyers will benefit from more secure products and greater transparency, as well as a clear expectation as to how long products will receive security updates.
For the market, the CRA sets new cybersecurity standards, which could influence global regulations, similar to how GDPR impacted privacy laws worldwide.
Bugcrowd can help organizations achieve CRA compliance in several ways. First, as manufacturers are primarily responsible for ensuring that their products meet CRA security requirements, they can invest in a managed bug bounty program or in penetration testing as a service. The second great use case has to do with vulnerability management. Vulnerability disclosure programs create streamlined vulnerability handling procedures.
The EU CRA is a major step towards strengthening the cybersecurity of digital products in the European market. It promotes a proactive approach to security, ensuring that companies prioritize cybersecurity throughout the product lifecycle and that consumers are better protected against cyber threats.
For more insights into EU security regulations, check out our blogs on DORA, the NIS2 Directive, and the EU AI Act.