Understanding the Cyber Resilience Act

Margaret Ellis

Welcome to another episode of Tributech's Come Reflect Act. I’m Margaret Ellis, and as always, I’m joined by David Evans. Today, we’re diving into the Cyber Resilience Act, or CRA, which is, well, it’s really set to shake up the way connected products are handled across the EU.

David Evans

Yeah, and, you know, Margaret, I think a lot of folks still don’t realize just how sweeping this regulation is. The CRA is basically the EU’s way of saying, “Hey, if you’re making, selling, or even importing anything with a digital component, you’ve got to step up your cybersecurity game.” It’s not just about patching things up after the fact anymore.

Margaret Ellis

Exactly. The CRA is a regulatory framework, and its main goal is to harmonize cybersecurity requirements for digital products across the EU. So, it’s not just about ticking a box—it’s about making sure security is built in from the very start, all the way through to post-market support. That means manufacturers, distributors, and importers are all on the hook for keeping products secure throughout their entire lifecycle.

David Evans

And the objectives are pretty clear: stricter cybersecurity standards, more transparency, ongoing vulnerability management, and, you know, really standardizing how everyone approaches this stuff across the EU. I was actually working with a startup last month—small team, really sharp folks—and they were just floored when they realized the CRA wasn’t just for the big players. They thought, “Oh, we’re just making smart thermostats, we’re not a target.” But the CRA doesn’t care how big you are. If your product’s digital and it’s in the EU, you’re in scope.

Margaret Ellis

That’s such a good point, David. The CRA is about reducing risk for everyone—users, businesses, even critical infrastructure. And, honestly, it’s positioning the EU as a leader in global cybersecurity standards. It’s ambitious, but it’s necessary given the threats we’re seeing these days.

David Evans

So, let’s talk about what’s actually covered. The scope is, well, it’s massive. We’re talking about everything from consumer IoT—like your smart fridges and wearables—to industrial systems, software, routers, servers, you name it. If it’s got a digital element and it could pose a cybersecurity risk, it’s probably in.

Margaret Ellis

And that includes software, too. Not just the hardware. So, operating systems, productivity tools, web apps—if it interacts with data or networks, it’s under the CRA’s umbrella. I recently worked with a London-based IoT manufacturer, and they had to map out every single product line to see which ones fell under the CRA. It was eye-opening for them, because even some legacy products—things they hadn’t thought about in years—suddenly needed a compliance plan.

David Evans

Yeah, and the timeline is, well, it’s tight but not impossible. The CRA was adopted in November 2024, came into force in December 2024, and now manufacturers have 36 months to get their act together. So, by December 2027, you’ve got to be fully compliant. But here’s the catch—some reporting requirements kick in after just 21 months, on September 2026, the technical requirements and the final deadline following 15 months after that. So, you can’t just wait until the last minute.

Margaret Ellis

No, definitely not. And for companies with a big product portfolio, that’s a lot of work to do in a relatively short time. The key is to start early—get your inventory sorted, figure out what’s in scope, and start mapping those requirements now. Otherwise, you’re going to be scrambling when the deadlines hit.

David Evans

Alright, so let’s get into the nitty-gritty—what do you actually have to do to comply? First up, every product needs a cybersecurity risk assessment. That’s your starting point. Then, there are 13 essential cybersecurity requirements and 8 vulnerability handling requirements you’ve got to meet. And don’t forget the paperwork—technical documentation, user instructions, and an EU declaration of conformity. It’s a lot.

Margaret Ellis

It is, and the consequences for missing the mark are, well, they’re pretty severe. We’re talking fines up to €15 million, or 2.5% of your global annual turnover—whichever is higher. And that’s not all. Authorities can recall your products or even ban them from the EU market entirely. That’s a huge risk for any company relying on European customers.

David Evans

Yeah, and the assessment procedures are worth mentioning. If your product is in the “default category,” you can self-assess—basically, you check your own homework. But if you’re dealing with higher-risk devices, you’re looking at stricter, third-party assessments. So, it’s not a one-size-fits-all approach, and you really need to know where your products land.

Margaret Ellis

Absolutely. The bottom line is, the CRA isn’t just another box to tick. It’s a fundamental shift in how digital products are designed, built, and supported in the EU. If you’re not already planning for it, now’s the time to start. And, of course, we’ll be here to help guide you through it as the deadlines get closer.

David Evans

Yeah, we’ll keep breaking it down in future episodes. Margaret, always a pleasure chatting with you about this stuff.

Margaret Ellis

Likewise, David. Thanks for joining us, everyone. We’ll see you next time on Tributech's Come Reflect Act. Take care.

David Evans

Bye, everyone.