Cyber Resilience Act

The Cyber Resilience Act, or CRA for short, is a law of the European Union. It stipulates that products with digital components — that is, software, networked devices, and apps — must be built securely from the outset and supplied with security updates on an ongoing basis. The law was passed in 2024 and becomes binding from 2027 for all companies wishing to sell such products in the EU. Anyone who fails to comply risks heavy fines and will no longer be allowed to offer their product on the European market. The CRA is thus the first law worldwide to regulate minimum security requirements for digital products in such a comprehensive and legally binding manner.

Why the CRA marks a turning point for the industry

Until now, it was common practice to sell products with known security vulnerabilities and to provide updates only for as long as it suited the manufacturer economically. For consumers, this meant that a router, a smart doorbell, or an industrial controller could become a security risk after just a few years — without the manufacturer being obligated to fix it.

The CRA changes this fundamentally. Manufacturers must now actively report security vulnerabilities and close them with updates throughout the product’s entire “support period” — at least five years. That may sound self-evident, but in practice it has not been so far. Many cheap Internet-of-Things devices — that is, networked everyday gadgets — were sold for years without any security maintenance whatsoever. This is precisely what prompted lawmakers to act.

What the CRA specifically requires from manufacturers

The law distinguishes between products according to their level of risk. Simple products — such as a Wi-Fi-enabled table lamp — must meet basic requirements and can self-certify. More critical products, such as password managers or firewalls, require independent assessment by an external body. For particularly security-critical infrastructure, the strictest rules apply.

Concretely, this means for manufacturers: they must take security risks into account already at the design stage of a product — not only once customers start complaining. This principle is called “security by design,” meaning security as a built-in feature from the very start. In addition, vulnerabilities must be reported to the responsible EU authority within 24 hours of their discovery. This is a very short window that many companies will need to reorganize internally to meet.

Important: the CRA does not only apply to companies based in the EU. Anyone selling a digital product in the EU — whether from the US, China, or any other country — must meet the requirements. This makes the law a genuine global lever, similar to how the GDPR data protection regulation from 2018 functioned for the handling of personal data.

Where the CRA shows up in practice

In business news, the CRA mainly comes up in debates surrounding open-source software. Many developers who publish their code for free and voluntarily fear suddenly being classified as “manufacturers” and thus becoming liable. The EU has since clarified that non-commercial open-source projects are generally exempt — but the exact boundary remains disputed.

For consumers, the CRA will become most noticeable when buying smart-home devices, game consoles, networked cameras, or fitness trackers. From 2027, all these products must be sold with a clearly stated update guarantee — similar to an expiration date. When buying a device, it should be apparent how long the manufacturer will support it with security updates.

In the tech industry, the CRA is often mentioned in the same breath as the GDPR, because it uses a similar mechanism: strict European rules that have worldwide effect because no company wants to forgo the EU market. Critics warn that the law could overwhelm smaller software developers. Supporters see it as long-overdue consumer protection for the digital age.