This week marks a major milestone in the phased introduction of the EU’s Cyber Resilience Act (CRA), with the introduction of new requirements for products with digital elements.
The aim is to make developers and manufacturers more responsible for cybersecurity, to tighten up reporting requirements, and to ensure that they deal with any problems promptly.
“The Cyber Resilience Act will strengthen the cybersecurity of connected products, tackling vulnerabilities in hardware and software alike, making the EU a safer and more resilient continent," said lead MEP Nicola Danti.
So what do the changes mean? Here are three things businesses need to know about the legislation.
Cyber Resilience Act imposes Initial reporting requirements
First, manufacturers must now notify the European Union Agency for Cybersecurity (ENISA) of any actively exploited vulnerabilities within 24 hours. The report should include any relevant information, such as whether the event might be malicious.
They should then provide a full report within 72 hours, including an initial assessment of the severity of the incident, the type of vulnerability, any mitigation measures that have been taken and recommended actions for users.
A final, detailed report will need to be submitted within 14 days in the case of an actively exploited vulnerability or a month for a severe security incident.
Ilkka Turunen, field CTO at Sonatype, said many organizations may struggle to comply on this front, largely thanks to a lack of clear understanding of the software they ship.
"The average software supply chain is over 180 external components, and in 2025 Sonatype found nearly 1.8 billion downloads that had risks with fixes available, but ignored. This shadow inventory is set to grow with the rise of AI development," he said.
“Teams need to know which products contain the affected components, which versions are exposed and inform both the regulator and their customers. If that picture has to be reconstructed manually during an incident, the reporting window will be nearly impossible to meet."
Focus on full lifecycle
Cybersecurity risks need to be considered across the full lifecycle of the product, including planning, design, development, production, delivery and maintenance.
Assessments will need to be documented and updated throughout a product’s supported life.
These new requirements apply to all products with digital elements that are available in the EU, including those already on the market.
“For developers not used to operating in regulated industries, particularly those designing individual elements or components embedded into wider products, this creates several new challenges," said Andrew Longhurst, managing director at Wittenstein High Integrity Systems.
"Chief amongst them is designing ‘out-of-context’ – building (and securing) a hardware or software element before knowing its final application or end-user environment. This will impact developers both upstream and downstream and could prove a major hurdle for those wishing to continue selling into Europe."
Penalties
The cost of noncompliance is high. Organizations face fines of up to €15 million or up to 2.5% of their total worldwide annual turnover for the preceding financial year, whichever is higher.
"European firms are now having to build security directly into their products from the design phase and will have a significant global advantage," said Vincent Lomba, chief product security officer at Alcatel Lucent Enterprise.
"As a result, these rules will establish a new international benchmark. It will force tech suppliers around the world to up their resilience practices in order to continue to compete with the European supply chain."
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
US accuses Chinese firms of ‘aggressively’ copying frontier models
AI's operational blind spots
