The EU Cyber Resilience Act (CRA): What Every Business Needs to Know

The EU Cyber Resilience Act (CRA), formally adopted in late 2024, is the most significant piece of cybersecurity legislation since GDPR. It establishes mandatory cybersecurity requirements for all products with digital elements sold in the European Union.

Why the CRA Exists

The EU estimated that cyberattacks cost the global economy €5.5 trillion annually. Yet most connected products — from smart thermostats to enterprise routers — ship with minimal security testing, default passwords, and no obligation to provide security updates. The CRA changes this fundamentally.

What's in Scope

Any product with digital elements placed on the EU market. This includes:

• Hardware with embedded software (IoT devices, routers, industrial controllers)
• Standalone software (operating systems, browsers, password managers)
• Remote data processing solutions integral to the product

Notable exclusions: SaaS (unless it's a remote data processing component), medical devices (covered by MDR), automotive (covered by UNECE), and aviation.

Three Product Categories

The CRA classifies products by risk:

• Default category — ~90% of products. Self-assessment allowed
• Important (Class I) — Password managers, VPNs, network management. Third-party assessment or harmonized standards
• Important (Class II) — Hypervisors, firewalls, HSMs, smart meters. Mandatory third-party assessment
• Critical — Hardware security modules, smart meter gateways. European cybersecurity certification

Key Timeline

• December 2024 — CRA enters into force
• September 2026 — Reporting obligations begin (vulnerability reporting)
• December 2027 — Full compliance required for all products

Business Impact

Non-compliance penalties can reach €15 million or 2.5% of global annual turnover, whichever is higher. But beyond fines, the CRA will reshape supply chains, procurement decisions, and product development lifecycles across every industry that uses digital products.