Cyber Resilience Act (CRA) Compliance Made Simple

Most products - software and hardware -  with possible connections to other devices are affected. We can help you analyze this question in detail - please get in touch with us.

The definition for products which are affected by the CRA is very broad.

The CRA applies to “products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network”.

Some examples what constitutes such products:

• Firmware / software meant for integration into hardware devices
• Software which is placed on the market with hardware product – pre-loaded or not, for example drivers for a printer, OS, tools to program FPGAs
• ICs, motherboards, sensors
• Smartphones, laptops, smart fridges
• Industrial IoT devices, machinery

But also: 

• offline text editors and other applications running on operating systems which have or can have a connection to other devices
• NFC tags and their readers, for example in doorlocks

There are some exceptions, for example products intended for national security purposes.

A counterexample for devices not affected by the CRA:

• a dishwasher with embedded firmware, but without a connection to other devices

Yes, your product will be affected. There is no grandfathering of existing product types, barring some exceptions.

From a legal perspective, each individual unit of a product type is considered as being "placed on the market".

"Placing on the market" translates to the manufacturer or importer making it available on the European market for the first time.

Each individual unit must conform to the European Conformity requirements valid at the time of it's placement on the market.

Thus, once the CRA enters into effect, new units of your product type manufactured and sold into the EU - to distributors, customers, importers - will need to be compliant with the CRA.

To allow products already shipped into the market to be supplied with spare parts, the CRA does not apply to unmodified spare parts.

Contact us to discuss details about your existing products, and how to accelerate compliance for them.

There are two important CRA deadlines most companies need to consider:

11.SEP. 2026: Start of reporting obligations

The reporting obligations for security incidents, and active breaches, also concern existing products.

11.DEC. 2027: Start of main CRA obligations

All existing products need to be reviewed to meet CRA requirements.

Grandfathering only exists for unmodified components intended to service devices already in the market.

Meeting the CRA requirements is an essential upcoming part of the CE certification.

Be sure that you are covering the CRA requirements appropriately with our expert guidance.

Often it is difficult to tell, whether you are doing enough. Security engineering efforts can increase exponentially, and risk targeting the wrong problem.

A balance with a realistic risk-based approach is key to expending the right amount of efforts on the right problems.

We continuously upskill our team members, and are able to bring CRA best practices into your team.

Thus, pi3g combines market knowledge and deep engineering expertise, to help you pick the right challenges to focus on.

For us it's important to work on-point and within the scope of our domain expertise.

Inquire with us for your project, to evaluate whether we will be able to support the technologies you are using.

As a general first overview, we do not support the following technologies:

• Android and iOS applications
• SAP and ABAP applications
• Windows-based embedded systems