EU Cyber Resilience Act

## What the CRA is The EU Cyber Resilience Act (Regulation (EU) 2024/2847) is product-safety law applied to cybersecurity. Its logic is the same one the EU already uses for electrical safety or machinery: if you want to sell a thing in the single market, the thing must meet essential requirements, you must be able to show it does, and you affix a CE marking saying so. What is new is that the essential requirements are about security, and that they do not stop at the moment of sale - they run for a declared support period afterwards. It entered into force at the end of 2024. The bulk of the obligations apply from late 2027, with the vulnerability-reporting duties starting roughly a year earlier, which is why the question is already live in interviews. ## What counts as a product with digital elements A product with digital elements is any software or hardware product, plus its remote data processing solutions, made available on the EU market. In practice that sweeps in far more than consumer IoT: - connected hardware - a thermostat, a router, a industrial gateway - and its firmware - hardware with software that never goes online at all - standalone software sold as a download or on a subscription, including desktop and mobile applications - software and hardware components placed on the market separately, sold business-to-business rather than to end users; each is a product in its own right with its own manufacturer A `remote data processing solution` is in scope when it is integral to the product: the product cannot perform its function without it. The backend a smart lock calls to open is in; a general-purpose cloud service you sell as a service is not a product with digital elements at all, and its security obligations come from elsewhere in EU law such as NIS2. Out of scope: products already governed by sector-specific EU regimes (certain medical devices, motor vehicles, civil aviation), and free and open-source software supplied outside a commercial activity - the individual contributor, the unpaid project - which the regulation deliberately excludes, while giving organisations that systematically sustain such projects a separate, lighter steward regime. ## Who carries the duties The central role is the manufacturer: the party that develops or has developed a product and markets it under its own name or trademark. Two consequences catch people out. 1. **Rebranding transfers the role.** Buy a white-label device, put your logo on it, sell it in the EU: you are the manufacturer, and the essential requirements, the vulnerability handling and the reporting clock are yours, not the original maker's. Your recourse against your supplier is a contract you have to write; it is not a defence to the regulator. 2. **Substantial modification transfers it too.** If you modify a product in a way that changes its intended purpose or affects its compliance, you take on the manufacturer's duties for the modified product. A pure security update that fixes a flaw without changing intended purpose is not a substantial modification - otherwise patching would be punished. Importers and distributors sit below the manufacturer: they must not place non-compliant products on the market, must check that the CE marking and documentation are present, and must inform the manufacturer and market surveillance authorities when they learn of a problem. Open-source software stewards - legal entities providing sustained support for open-source products used commercially - have their own tailored set. ## The two duty families Everything a manufacturer owes falls into two groups. First, essential product requirements: secure-by-default configuration, no known exploitable vulnerabilities at the moment the product is placed on the market, appropriate access control, protection of data confidentiality and integrity, minimised attack surface, resilience against denial of service, security-relevant logging, and the ability to deliver updates. Second, vulnerability-handling requirements: keep a software bill of materials covering at least the top-level dependencies in a commonly used machine-readable format, remediate vulnerabilities without delay, provide free security updates, run a coordinated vulnerability disclosure policy with a published contact address, and report actively exploited vulnerabilities to the authorities. ## Conformity and enforcement Most products self-assess against the requirements and self-declare. Categories the regulation calls important and critical - things like password managers, identity systems, or hypervisors - escalate towards third-party assessment or certification. Enforcement is national market surveillance, with fines for breaching the essential requirements reaching the higher of 15 million euro or 2.5% of worldwide annual turnover, so the exposure is not a rounding error. The interview point is simply this: work out whether you are in scope and who in your supply chain is the manufacturer before arguing about controls, because the answer decides whose problem everything else is.