The CRA is a CE topic like any other, and we can help you with it

Cybersecurity is becoming an increasingly important part of product development. With the Cyber Resilience Act (CRA), Europe is introducing new cybersecurity requirements for products with digital elements.

Since 11 September 2026, manufacturers have been required to report severe security incidents, and from 11 December 2027 the full regulation will become applicable.

A familiar approach

This may sound like a major change, but the approach is surprisingly familiar. Just like EMC, LVD, RED or machinery safety, the CRA follows the well-known CE route: a risk assessment, the application of standards, a technical file and a Declaration of Conformity signed by the manufacturer.

You know your machine or device, your users and its intended use. We help with the technical implementation of cybersecurity in electronics and embedded software. Together, we provide the expertise needed to achieve CRA compliance.

What is new is that manufacturers remain responsible after market launch for monitoring vulnerabilities and providing security updates throughout the expected lifetime of the product, with a minimum support period of five years.

What does the CRA require?

The CRA is built on three key principles:

• Security by design: from electronics and firmware to apps and cloud environments;
• Monitoring vulnerabilities and providing security updates throughout the entire product lifecycle;
• • Reporting actively exploited vulnerabilities and severe security incidents within 24 hours.

Virtually every product with a wired or wireless data connection falls within the scope of the CRA. For most products, manufacturers can perform the conformity assessment themselves, similar to EMC or LVD compliance.

Key dates

• 1 Augustus 2025: RED cybersecurity requirements (EN 18031) apply to radio equipment.
• 11 September 2026: CRA incident reporting obligations become applicable, including for products already on the market.
• 20 January 2027: The new Machinery Regulation replaces the Machinery Directive.
• 11 December 2027: The full CRA becomes applicable.

A useful first step is to establish a simple vulnerability handling process: who receives reports, who decides on the response and who is responsible for reporting? Our CRA whitepaper provides a practical starting point.

Overlap between the Machinery Regulation and the CRA

Machine builders should be aware that the new Machinery Regulation also introduces cybersecurity requirements, focusing on protection of safety-related software, recording modifications and interventions and the visibility of the software version to the user. The harmonised standard prEN 50742 is currently still under development.

Because there is significant overlap between the Machinery Regulation and the CRA, both compliance efforts can often be addressed together.

Also existing products also deserve attention

Please note: the CRA also applies to existing products that remain on the market after December 2027, even if the design has been part of your product portfolio for many years. That is why a risk assessment of the current product is often the ideal first step.

In some cases, products are already well prepared. In others, additional measures may be necessary. Adding cybersecurity to an existing design should not be underestimated. Typical challenges include:

• Hardware that does not support secure boot;
• Insufficient secure storage capabilities;
• Not enough memory for signed software updates.;
• The absence of an update mechanism.

The sooner you gain insight into your situation, the more options you will retain.

Your role and ours

• As the manufacturer, you remain responsible for: the intended use, users and operating environment, the risk assessment, the technical documentation and The Declaration of Conformity.
   
• We support you with the implementation of:
  • Secure hardware and software architectures tailored to your security requirements.
  • Security features such as secure boot, signed updates, encryption and access control.
  • Technical input for your risk assessment, including device threat modelling.
  • An SBOM (Software Bill of Materials), test-ready software builds and support during independent testing.
  • Security updates after product launch.

Getting started today

As with any CE compliance topic, the CRA works best when you take ownership of the process. Companies that start early typically achieve compliance faster and retain the greatest flexibility.

A valuable first step is to bring together the right experts for each product family: your own team, compliance specialists and our engineers. Together, we map the product, determine which regulatory requirements apply and identify potential gaps. This quickly provides a clear action plan and highlights where we can support you.

>>> Contact our cybersecurity team at +32 3 620 18 18 or send us an e-mail.

Funding for SMEs

Financial support is available for SMEs. On 1 October 2026, the European SECURE project launched a second funding call with a budget of €11.5 million for micro, small and medium-sized enterprises requiring support with CRA implementation.

Applications can be submitted until 11 December 2026. It is certainly worth checking whether your company and project qualify.

Additional information:

• In our whitepaper "The rules are changing – 'REDy' or not?" (May 2025) ), we examined cybersecurity requirements for radio products under the RED. Download your copy via the button below.
   
• In the whitepaper "CRA: Software compliance on the rise, first steps toward 2027" (April 2026), we looked ahead to the Cyber Resilience Act. Download your via the button below.