What the CRA Changes for Connected Products
The EU Cyber Resilience Act, Regulation (EU) 2024/2847, makes cybersecurity part of product compliance for hardware and software sold in the EU. Reporting obligations for actively exploited vulnerabilities and severe security incidents have applied since September 11, 2026. The regulation applies in full from December 11, 2027, when cybersecurity becomes part of CE conformity for products with digital elements.
For connected-device teams, the scope can extend beyond the PCB. It may include firmware, companion apps, software components, and remote processing required for the product to function.
The CRA divides products into four categories:
| Product class | Typical route | Examples |
| Default | Manufacturer self-assessment | Many standard connected products. |
| Important Class I | Self-assessment only when the required standards or schemes are fully applied; otherwise third-party assessment. | Routers, smart locks, security cameras, some connected toys and health wearables. |
| Important Class II | Third-party assessment. | Firewalls, intrusion-detection systems, tamper-resistant processors. |
| Critical | Stronger certification requirements. | Secure elements, smartcards, security boxes, some smart-meter gateways. |
Manufacturers carry the main responsibility for security design, updates, vulnerability handling, and documentation. Importers and distributors also have duties to verify that compliant products and documentation are being placed on the EU market.
Security Requirements Must Be Designed Into the Hardware
CRA compliance is not something that can be added shortly before launch. Some of the most important security choices are fixed when the hardware architecture is defined.
Connected products should plan for:
- A hardware root of trust and secure boot.
- Protected storage for device keys.
- Unique credentials for each unit.
- Controlled or disabled debug interfaces.
- Secure-by-default configuration.
- Signed firmware updates.
- Enough memory for updates throughout the support period.
- Rollback protection against older vulnerable firmware.
The product also needs a cybersecurity risk assessment covering intended use, foreseeable misuse, attack surfaces, update mechanisms, known vulnerabilities, and the promised support period.
An SBOM, or software bill of materials, should identify the software components and dependencies included in each release. This allows teams to determine quickly which products and firmware versions are affected when a vulnerability appears.
The same principle applies to release documentation. Hardware revision, firmware version, SBOM, security testing, update history, and known issues should stay connected so the company can show exactly what was shipped.
AJProTech approaches these requirements as hardware and firmware architecture decisions. Root of trust, secure key storage, update capacity, memory planning, and debug access are far easier to solve before the PCB is frozen than after production starts.
Reporting, Updates, and Production Evidence
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting products available on the EU market.
The reporting timeline includes:
- Within 24 hours: Early warning to the relevant national CERT and ENISA.
- Within 72 hours: Main notification with additional information.
- After remediation: Final reporting within the applicable CRA deadline.
That means companies need a real vulnerability-response process, not only a policy document. Someone must own security reports, assess whether exploitation is active, coordinate fixes, and track affected product versions.
Each release should preserve evidence connecting:
- Hardware revision and BOM.
- Firmware version and signed build.
- SBOM.
- Security test results.
- Known vulnerabilities and decisions.
- Update availability.
- User instructions.
- Support-period end date.
- Required regulatory reports.
The CRA also requires manufacturers to define a security support period based on expected product lifetime. According to the regulation, this is generally at least five years unless the expected use period is shorter.
For connected hardware teams planning products for the EU, cybersecurity now belongs beside EMC, radio, safety, and other CE requirements. AJProTech can help teams build secure boot, key protection, update architecture, firmware controls, and release evidence into the product before these requirements become expensive late-stage changes.
FAQ
When does the Cyber Resilience Act apply?
Incident and vulnerability reporting obligations started on September 11, 2026. The broader product, conformity, documentation, and CE marking requirements apply from December 11, 2027.
Does the CRA apply to existing products?
Reporting obligations can already apply to products available on the EU market. Older products can also come under broader CRA requirements if they undergo a substantial modification after the full regulation becomes applicable. AJProTech’s custom hardware engineering services include updating existing products to new compliance standards.
Does the CRA require an SBOM?
Yes. Technical documentation must identify software components and dependencies, including an SBOM in a commonly used machine-readable format covering at least top-level dependencies.
How long must security updates be provided?
The manufacturer defines the support period based on expected product lifetime. It must generally be at least five years unless the product is expected to be used for a shorter period.
Does the CRA replace RED cybersecurity requirements?
No. Connected radio products can face both Radio Equipment Directive cybersecurity requirements and CRA obligations, depending on product scope and launch timing.
What are the penalties for non-compliance?
Authorities can require corrective action, restrict sales, or withdraw a non-compliant product. For serious breaches, fines can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher.
