EU-wide cybersecurity for digital products

On 20 November 2024, the Cyber Resilience Act, the new law on cybersecurity requirements for products with digital elements, was published in the EU Official Journal. 

The new regulation will enter into force twenty days after publication in the Official Journal of the EU (10 December 2024) and will apply directly in every EU member state 36 months after this entry into force, namely from 11 December 2027.

Some provisions will apply earlier: 

• 11 June 2026: The provisions on the notification of conformity assessment bodies apply.
• 11 September 2026: The reporting obligations for actively exploited vulnerabilities and severe incidents pursuant to Article 14 CRA apply.
• 11 December 2027: The remaining provisions of the CRA generally become applicable.
   

The new ‘Cyber Resilience Act’ is intended to ensure that digital products become more secure for individuals and businesses. Manufacturers of such products, both hardware and software, will be obliged to use software updates to fix vulnerabilities and to inform the end users of their products about possible cybersecurity risks. In addition, the regulation defines requirements for software development and thus also emphasises the ‘security by design’ required by the ‘Cyber Security Act’ already in force.
 

The overarching aim of the Cyber Resilience Act is to improve the cybersecurity of hardware and software products on the EU internal market. The Commission has defined four key objectives of the legislation:

1. Ensure that manufacturers improve the security of products with digital elements from the design and development phase and throughout their entire life cycle.
2. Ensure a coherent cybersecurity framework that facilitates compliance for hardware and software manufacturers
3. Improve transparency regarding the security features of products with digital elements
4. Enable businesses and consumers to use products with digital elements securely
    

The scope of the regulation shows that this area is very broadly defined:

‘This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.’

Given the broad definition of products with digital elements, the regulation thus covers both hardware products such as machines and IoT devices as well as software products.

Exceptions are also mentioned in the scope of application; for example, medical devices according to Regulation (EU) 2017/745 do not fall within the scope of the regulation.

The CRA also addresses its interaction with Delegated Regulation 2022/30, which already establishes cybersecurity requirements for certain internet-connected radio equipment under the Radio Equipment Directive 2014/53/EU. To avoid regulatory overlap, Delegated Regulation (EU) 2022/30 will be repealed. The corresponding legal act was published in the Official Journal of the European Union on 29 April 2026 and provides for the repeal to take effect in December 2027, in connection with the general application of the CRA.
 

In line with other EU legislation, such as the Machinery Directive and the Low Voltage Directive, the Cyber Resilience Act also provides for a conformity assessment procedure.

At the core of this procedure is what we refer to here as the “cyber risk assessment”. This creates a useful parallel, particularly for machinery manufacturers, with the risk assessment already familiar from machinery safety. The CRA itself refers to an “assessment of the cybersecurity risks”. Article 13(2) provides:

‘[...] manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing incidents and minimising their impact, including in relation to the health and safety of users.’

Depending on the criticality of the products, the conformity assessment procedure distinguishes between self-certification and two procedures in which notified bodies must be involved. Details can be found in the factsheet on the Cyber Resilience Act.

In our view, the details point 2 of Annex VII of the regulation are particularly noteworthy for manufacturers. The document mentions various aspects (design, development, production, vulnerability analysis) as content for the technical documentation. Accordingly, software architecture decisions as well as decisions relating to development and build processes will need to be documented in the software development process in the future. For manufacturers, this may result in additional documentation requirements. In particular, the rapid technological development of software development tools (e.g. for build processes) will certainly present companies with organisational challenges in the future that can be overcome but should not be underestimated.

The relevant provision reads as follows

"CONTENTS OF THE TECHNICAL DOCUMENTATION

(…)

a description of the design, development and production of the product with digital elements and vulnerability handling processes, including:

(a) necessary information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing;

(b) necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates;

(c) necessary information and specifications of the production and monitoring processes of the product with digital elements and the validation of those processes;'
 

The German Federal Office for Information Security (BSI) is providing support for manufacturers in identifying the CRA requirements with the publication of the Technical Guideline TR-03183. Further information can be found in our technical article ‘Technical guideline for cyber resilience requirements’.
 

The reporting obligations under the Cyber Resilience Act will apply from 11 September 2026. From that date, manufacturers will be required to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.

For these notifications, ENISA provides the Single Reporting Platform (SRP), which serves as a central reporting point and enables manufacturers to submit a notification only once. When submitting a notification, the manufacturer selects the competent CSIRT (Computer Security Incident Response Team) as the coordinator. As a general rule, the competent CSIRT is determined by the Member State in which the manufacturer has its main establishment. The notification is also made available to ENISA and, where necessary, forwarded to other affected CSIRTs and market surveillance authorities.

The CRA provides for a multi-stage reporting procedure. An early warning must be submitted within 24 hours of becoming aware of a reportable vulnerability or incident. Within 72 hours, manufacturers must provide additional information and an initial assessment. A final report must subsequently be submitted. For actively exploited vulnerabilities, the final report is due no later than 14 days after a corrective or mitigating measure becomes available. For severe incidents, it must be submitted no later than one month after the 72-hour notification.

ENISA now provides specific guidance on registration and use of the SRP as well as on submitting and updating notifications. Manufacturers should therefore familiarise themselves with the platform at an early stage and establish internal processes for identifying and assessing potentially reportable vulnerabilities and incidents and for handling notifications within the applicable deadlines.
 

On 3 February 2025, the Commission officially called upon the European standardisation organisations CEN, CENELEC and ETSI to draw up “harmonised standards for the essential cybersecurity requirements set out in Annex I to this Regulation”. As part of this standardisation request, the Commission aims to take into account existing European and international standards in the field of cybersecurity that have already been published or are currently being developed.

The main document of the standardisation request contains the recitals as well as formal aspects such as reporting and validity; the annexes to the request set out specific lists of the new European standards to be developed (Annex I) and their requirement profiles (Annex II), categorised into horizontal and vertical standards.

Horizontal standards (lines 1–15 in Annex I) are intended to establish a coherent general framework regarding security requirements and the management of vulnerabilities. Vertical standards, on the other hand (lines 16–41), cover security requirements for specific product categories.

In their webinar ‘Standards supporting the Cyber Resilience Act’¹, CEN/CENELEC also presented a hierarchical model of such future CRA standards, which is strongly reminiscent of the division into Type A, B and C standards in the Official Journal of the European Union for the Machinery Directive and the Machinery Regulation respectively. Here too, the following applies:

• Type A standards (fundamental safety standards) are intended to serve as a framework for all elements set out in Section 1 of this Annex and specify the key elements that must be included in other product safety standards for the purposes of the Cyber Resilience Regulation.
• Type B standards (specialised safety standards) are intended to provide a comprehensive and useful overview of the relevant security mechanisms that may apply to products falling within the scope of the Cyber Resilience Regulation. A distinction is made here between Type B standards for product-independent technical measures and standards on vulnerability management
• type-C-standards are the vertical cybersecurity standards for specific product categories under the CRA. A distinction is made here between ‘important’ and ‘critical’ products.

According to the information provided in the webinar, the deadline for the adoption of the horizontal Type A standard(s) and the Type B standards on vulnerability management is set for 30 August 2026 at the latest. Type-C standards for the individual product categories must be in place by 30 October 2026; shortly before the CRA comes into force on 11 December 2027, the Type B standards for technical measures will follow (30 October 2027). At present, it seems likely that the 2026 deadlines in particular will not be met – for this reason, an amendment to the CRA standardisation request is planned, under which the two deadlines are to be postponed by two months. This amendment is currently only available as a draft; final publication of the corresponding implementing decision in the Official Journal of the EU is still pending.

An overview of the future categorisation and its planned implementation (based on current information) can be found in the chart below²:

The standardisation mandate explicitly refers to ‘new European standards to be drafted’. Nevertheless, CEN, CENELEC and ETSI could draw on existing documents.

Examples of such standards and specifications that could potentially be harmonised to meet the CRA requirements are:

• EN 18037: Guidelines on a sectoral cybersecurity assessment
• EN ISO/IEC 15408 series parts 1-5: Information security, cybersecurity and privacy protection - Evaluation criteria for IT security
• EN 17640: Fixed-time cybersecurity evaluation methodology for ICT products
• EN ISO/IEC 29147:Information technology - Security techniques - Vulnerability disclosure
• prEN 40000-1-3: Cybersecurity requirements for products with digital elements - Part 1-3: Vulnerability Handling
• EN ISO/IEC 30111: Information technology - Security techniques - Vulnerability handling processes
• EN 303 645: Cyber security for consumer internet of things

In line with the new Machinery Regulation (EU) 2023/1230, the Commission may, in the absence of harmonised standards for the cybersecurity requirements of Annex I, adopt implementing acts with common specifications for technical requirements. The legislator reserves this option in case the desired standards are not delivered within the set deadline, the standardisation mandate is not accepted or the content of the documents does not comply with the mandate.

The following documents are a valuable source of information for machine manufacturers:

• CLC IEC/TS 63074: Safety of machinery - Security aspects related to functional safety of safety-related control systems
• Parts of the EN IEC 62443 series: Security for industrial automation and control systems
• CEN ISO/TR 22100-4: Guidance to machinery manufacturers for consideration of related IT-security (cyber security) aspects
• prEN 50742: Safety of machinery - Protection against corruption

The NIS 2 Directive primarily addresses the cybersecurity of essential and important entities and their network and information systems. Entities within its scope are required to take appropriate and proportionate measures to manage cybersecurity risks. In our technical article "NIS-2 Directive in mechanical engineering", we explain which companies are directly affected (as operators) and what requirements and sanctions the directive provides for.

The Cyber Resilience Act, by contrast, lays down cybersecurity requirements for products with digital elements and addresses the economic operators involved, in particular manufacturers.

In simplified terms, NIS 2 therefore focuses primarily on the cybersecurity of entities and their network and information systems, whereas the CRA focuses on the cybersecurity of products with digital elements throughout their lifecycle.