EU Cyber Resilience Act

Impact and actions

Obligations under the CRA include “security by design” and specific security safeguards that products must meet. This includes risk assessments, cyber incident reporting, vulnerability management and transparency obligations to ensure a high level of cybersecurity throughout the entire product lifecycle. The European Union Agency for Cybersecurity (ENISA) will be closely involved to provide cybersecurity certification standards, e.g. EUCC, EUCS, EU5G and EUAI, and to monitor large scale vulnerabilities in the European market. For example, software and hardware products will bear the “CE-marking” to indicate that they comply with the regulation’s requirements. Although the CRA harmonises standards across the EU, some member states are taking extra steps. E.g., the German BSI is publishing technical guidelines and Austria has published an implementation law.

Practical outlook

Businesses will now need to review which of their products are likely to fall within the scope of the regulation and the extent to which they meet essential security requirements. Especially considering the timeline of product design, manufacturers are now getting ready for Q4 of 2027.

In cases of non-compliance, products could be restricted from the EU market. Like pre-existing laws such as the NIS2 or the GDPR, the CRA introduces administrative fines of up to EUR 15 mio or 2.5% of a business's annual worldwide turnover.

Please reach out to your Eversheds Sutherland team to discuss any queries around the CRA and its implementation. Our worldwide team is here to assist you and put you in touch with the right contacts.