EU Cyber Resilience Act (CRA)
19 March, 2026
Protect Technology Assets. Reduce Risk. Stay Competitive.
New EU Cybersecurity Rules. Real Commercial Impact.
The EU Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for products with digital elements sold into the EU.
From December 2027, products that don't meet CRA requirements cannot be legally placed on the EU market - putting revenue, customer contracts, and CE marking at risk.
Does This Affect You?
The CRA applies if you manufacture, supply or integrate:
- Connected hardware or embedded systems
- Displays, compute modules, controllers, or smart devices
- Software or firmware used in connected products
- Components that form part of a digital system
If your product connects, communicates, or updates - CRA applies.
Why This Matters Commercially:
CRA is not just a compliance issue, it impacts:
- EU market access and CE marking
- Customer audits and procurement decisions
- Product lifecycle costs and support commitments
- Supply-chain responsibility and liability
- Time-to-market for new designs
Non-compliance can lead to market withdrawal and significant financial penalties.
Key Dates to Know:
- 10th December 2024 | CRA came into force in the EU
- 1st August 2025 | CRA device security requirements on OEM
- 11th September 2026 | First reporting obligations (e.g. incidents and vulnerabilities)
- 11th December 2027 | Full CRA compliance and applicability begins for all relevant products
How RDS Supports CRA Ready Products:
RDS helps customers reduce risk and complexity by:
- Understanding what CRA means for your specific products
- Selecting and supplying compliant hardware and software
- Designing security-ready platforms from the outset
- Supporting documentation and lifecycle considerations
Whether you are designing new products, reviewing existing platforms, or managing EU customer requirements, we help turn CRA from a risk into a managed, commercial advantage.
Lets Talk About Your Products
If you want to understand how CRA impacts your roadmap, supply chain, or customers, speak to our team.