← Back to all briefings
Cybersecurity 5 min read Published Updated Credibility 93/100

European Parliament Adopts Cyber Resilience Act — March 12, 2024

The EU Parliament approved the Cyber Resilience Act in March 2024. Connected products need secure-by-design development, vulnerability disclosure processes, and CE marking. If you sell IoT in Europe, this is your roadmap.

Kodi C.

Editor & Research Lead

Fact-checked and reviewed — Kodi C.

Cybersecurity pillar illustration for Zeph Tech briefings
Cybersecurity threat, control, and response briefings

High-level summary

On , the European Parliament voted to adopt the Cyber Resilience Act (CRA), establishing full cybersecurity requirements for products with digital elements sold in the European Union. The regulation mandates secure-by-design development practices, coordinated vulnerability handling, CE marking for connected devices, and security update obligations throughout product lifecycles, with transition periods ranging from 12 to 36 months after entry into force.

Legislative Context

The Parliament's adoption represents a key milestone in the EU's full cybersecurity regulatory framework:

  • Commission proposal: The European Commission proposed the CRA in September 2022 to address critical gaps in product cybersecurity requirements.
  • Trilogue negotiations: Parliament, Council, and Commission engaged in extended negotiations to finalize the regulation's scope and requirements.
  • Final steps: Following Parliament adoption, Council formal adoption completes the legislative process before Official Journal publication.
  • Complementary framework: The CRA works alongside NIS2, sector-specific regulations, and the AI Act to create full EU digital security coverage.

Scope and Covered Products

The CRA applies broadly to products with digital elements:

  • Hardware products: Connected devices, IoT products, industrial control systems, networking equipment, and embedded systems.
  • Software products: Standalone software applications, operating systems, firmware, and software components.
  • Product categories: Consumer electronics, smart home devices, wearables, automotive components, medical devices, and industrial equipment.
  • Exclusions: Certain products already covered by equivalent sector-specific regulations (for example, medical devices, automotive), open-source software developed non-commercially, and national security applications.

Core Security Requirements

The CRA establishes essential cybersecurity requirements for all covered products:

  • Secure development: Products must be designed, developed, and maintained according to state-of-the-art cybersecurity practices, implementing security throughout the development lifecycle.
  • Security by design: Default configurations must focus on security, with attack surface minimization and defense-in-depth principles applied.
  • Vulnerability minimization: Products must be delivered without known exploitable vulnerabilities, with processes to identify and address security issues.
  • Data protection: Products must protect confidentiality, integrity, and availability of data they process or store.
  • Access control: Appropriate authentication and authorization mechanisms must protect against unauthorized access.

Vulnerability Handling Obligations

The CRA establishes full vulnerability management requirements:

  • Vulnerability identification: Manufacturers must implement processes to identify vulnerabilities in their products throughout the lifecycle.
  • Coordinated disclosure: Establish coordinated vulnerability disclosure processes enabling security researchers to report findings.
  • Incident reporting: Actively exploited vulnerabilities and significant security incidents must be reported to ENISA within 24 hours.
  • Remediation: Vulnerabilities must be addressed without delay through security updates distributed to users.
  • Documentation: Maintain documentation of identified vulnerabilities, remediation actions, and security updates.

Security Update Obligations

Manufacturers must ensure products receive ongoing security maintenance:

  • Free updates: Security updates must be provided to users free of charge throughout the support period.
  • Support period disclosure: Manufacturers must publicly communicate the expected support period at time of sale.
  • Minimum support: Support periods must be proportionate to expected product lifetime, with minimums established for different product categories.
  • Update distribution: Updates must be made available through accessible mechanisms enabling users to install patches.
  • End-of-support notification: Users must be informed when security support ends.

Conformity Assessment

Products must undergo conformity assessment before EU market placement:

  • Default category: Most products undergo manufacturer self-assessment with internal documentation and testing.
  • Important products (Class I): Products with elevated security implications face improved assessment requirements.
  • Critical products (Class II): High-risk products require third-party assessment by notified bodies.
  • CE marking: Compliant products needs to bear CE marking indicating conformity with CRA requirements.
  • Technical documentation: Manufacturers must maintain documentation demonstrating conformity.

Schedule and deadlines

The CRA establishes staged compliance deadlines:

  • Entry into force: The regulation enters into force 20 days after Official Journal publication.
  • 12-month obligations: Vulnerability reporting requirements to ENISA take effect 12 months after entry into force.
  • 36-month full compliance: All other CRA requirements apply 36 months after entry into force.
  • Notified body designation: Member states must designate conformity assessment bodies within the transition period.

Supply Chain Implications

The CRA creates obligations throughout the product supply chain:

  • Component suppliers: Suppliers of software and hardware components may need to provide security documentation to product manufacturers.
  • Software bill of materials: Manufacturers must document software components to support vulnerability tracking.
  • Importers: Must verify products comply with CRA requirements before placing them on the EU market.
  • Distributors: Must verify CE marking and cooperate with market surveillance authorities.

Compliance Program Development

If you are affected, begin developing CRA compliance programs:

  • Product inventory: Identify all products with digital elements destined for EU markets and assess CRA applicability.
  • Gap assessment: Evaluate current security practices against CRA essential requirements.
  • Process development: Establish secure development, vulnerability handling, and update distribution processes.
  • Documentation: Create technical documentation and conformity assessment procedures.
  • Standards alignment: Align with ISO/IEC 27001, ISO/IEC 29147, ISO/IEC 30111, and emerging harmonized standards.

Global Impact

The CRA will influence product security practices worldwide:

  • Extraterritorial reach: Any manufacturer selling products in the EU must comply regardless of headquarters location.
  • Standard setting: The CRA may influence global product security expectations similar to GDPR's impact on privacy.
  • Competitive implications: Compliance investments may favor manufacturers with mature security programs.

Closing analysis

The European Parliament's adoption of the Cyber Resilience Act marks a major moment for product security regulation globally. Organizations selling products with digital elements in EU markets needs to begin compliance preparations immediately, given the complexity of implementing full product security programs. The CRA establishes security-by-design as a market access requirement, fundamentally changing how connected products are developed and maintained.

More on this topic

Further reading from our research library.

Continue in the Cybersecurity pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • Cybersecurity Operations Playbook

    Use our research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.

  • Network Security Fundamentals Explained Practically

    A practitioner-focused guide to network security fundamentals covering firewalls, segmentation, IDS/IPS, DNS security, VPNs, wireless security, zero trust architecture, and traffic…

  • Small Business Cybersecurity Survival Checklist

    A budget-conscious cybersecurity checklist built specifically for small businesses. This guide covers foundational security policies, network hardening, employee training, phishing…

Coverage intelligence

Published
Coverage pillar
Cybersecurity
Source credibility
93/100 — high confidence
Topics
European Union · Product security · Secure by design · Regulation
Sources cited
3 sources (europarl.europa.eu, digital-strategy.ec.europa.eu, iso.org)
Reading time
5 min

Source material

  1. European Parliament — Cyber Resilience Act: press release
  2. European Commission — Cyber Resilience Act
  3. ISO/IEC 27001:2022 — Information Security Management Systems — International Organization for Standardization
  • European Union
  • Product security
  • Secure by design
  • Regulation
Back to curated briefings

Comments

Community

We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.

    Share your perspective

    Submissions showing "Awaiting moderation" are in review. Spam, low-effort posts, or unverifiable claims will be rejected. We verify submissions with the email you provide, and we never publish or sell that address.

    Verification

    Complete the CAPTCHA to submit.