Many of today’s electronic products connect to networks and other devices to communicate, exchange data, coordinate tasks, and receive software updates. These connections make everyday work-life tasks incredibly convenient. However, this convenience also comes with risks. Weaknesses in these products can give cyberattacks a way into trusted devices. Responding to an attack takes time and money. Even worse, reputational damage can last long after the incident. To help reduce these risks, the European Union (EU) established common cybersecurity requirements that set a baseline for product development.

The Cyber Resilience Act (CRA), adopted in October 2024, establishes the requirements framework. Companies supplying digital products to the EU market must consider the CRA, whether they sell directly or supply components for a customer’s finished product. The rules apply regardless of where a company is based or where development takes place.

The regulation applies to semiconductors sold separately. Manufacturers must exercise due diligence when incorporating third-party components into their products. Semiconductor intellectual property (IP) suppliers may need to provide security evaluation results and explain the assumptions for secure use.

The CRA addresses widespread product vulnerabilities, inconsistent security updates, and insufficient information for secure use. The CRA’s mandatory reporting phase took effect in September 2026. When manufacturers learn that a vulnerability in their product is being actively exploited, or that a severe incident has affected its security, an early warning must be submitted. A more detailed notification follows, with a final report explaining the findings and corrective measures. Manufacturers submit these notifications through the CRA’s Single Reporting Platform.

Source link