The Cyber Resilience Act at a Glance

New Standards for Digital Security

The Cyber Resilience Act (CRA) is a European regulation aimed at improving the cybersecurity of products with digital elements. It was presented by the European Commission in September 2022 and is part of the EU’s strategy to strengthen cybersecurity. The CRA focuses on defining minimum cybersecurity requirements for products placed on the EU market in order to minimize security vulnerabilities and counter cyber threats.

Objectives of the Cyber Resilience Act

Improving product security:
Products with digital elements should become more secure, both during development and throughout their use. This applies to hardware, software, and all devices that are connected to the internet or to each other.
Minimizing cyber risks:
The regulation is intended to ensure that vulnerabilities in products are reduced, making attacks such as hacking or data theft more difficult.
Increasing consumer confidence:
As products become more secure through the CRA, the confidence of consumers and businesses in digital technologies increases.
Clearer responsibilities:
Manufacturers and providers must ensure that their products are secure and meet certain cybersecurity standards. The CRA makes them liable for security vulnerabilities and deficiencies.

New Standards for Digital Security

Objectives of the Cyber Resilience Act

Improving product security:
Products with digital elements should become more secure, both during development and throughout their use. This applies to hardware, software, and all devices that are connected to the internet or to each other.
Minimizing cyber risks:
The regulation is intended to ensure that vulnerabilities in products are reduced, making attacks such as hacking or data theft more difficult.
Increasing consumer confidence:
As products become more secure through the CRA, the confidence of consumers and businesses in digital technologies increases.
Clearer responsibilities:
Manufacturers and providers must ensure that their products are secure and meet certain cybersecurity standards. The CRA makes them liable for security vulnerabilities and deficiencies.

Key Provisions of the CRA

Cybersecurity requirements:
Manufacturers of products with digital elements must implement cybersecurity measures throughout the entire lifecycle of a product, such as regularly providing security updates and closing security gaps.
Reporting obligations:
Companies must report significant vulnerabilities and incidents to the competent authorities. This creates greater transparency around security issues and enables better coordination in responding to cyberattacks.
Responsibility of manufacturers:
The CRA requires manufacturers to carry out security checks and assessments of their products before they are placed on the market.
Penalties and sanctions:
Failure to comply with the CRA requirements can result in substantial fines of up to 15 million euros or 2.5% of a company’s worldwide annual turnover.

Impact

For businesses:
Manufacturers and importers of digital products will need to revise their cybersecurity processes in order to meet the new requirements. This may lead to higher costs, but in the long term it will improve the quality and security of the products.
For consumers:
The CRA provides greater protection against cyberattacks and increases trust in the digital products available on the market.

The CRA is an important component of the EU’s efforts to strengthen digital sovereignty and to combat cyber threats, which are becoming increasingly significant in our ever more interconnected world.

Cyber Security