Cyber Resilience Act: security for connected products

In brief

The Cyber Resilience Act, CRA for short, is an EU regulation on cybersecurity requirements for “products with digital elements”. This means hardware and software that can connect directly or indirectly to a device or network: routers, cameras, controllers, industrial sensors, smart home devices, but also commercial software such as apps, operating systems or firmware. Areas with their own rules are excluded, for example medical devices, vehicles and aviation.

The CRA covers the entire life cycle. When it ships, a product must meet the essential requirements in Annex I: no known exploitable vulnerabilities, secure default settings, protection against unauthorized access and the ability to receive security updates. After that, the manufacturer must handle vulnerabilities and deliver updates for a support period that is generally at least five years (Art. 13). At the end of this comes the CE marking, which will also cover cybersecurity.

For most products, a self-assessment by the manufacturer is enough. For certain important and critical products, such as firewalls, network devices or smart cards, a harmonized standard or a notified body is needed, depending on the class.

Who it affects in South America

A manufacturer outside the EU counts as a manufacturer under the CRA as soon as its product is made available on the EU market. A company in Manaus that supplies control electronics to a machine builder in Italy therefore carries the manufacturer's obligations, provided it places the product on the market under its own name. It can appoint an authorized representative in the EU (Art. 18) to take on certain tasks.

Software companies with commercial products are affected in the same way: an accounting app from Santiago, security software from Buenos Aires, firmware for agricultural sensors from Rosario. With pure contract development, where the EU customer sells the product under its own name, the customer becomes the manufacturer. It will then pass the requirements on to you by contract.

Then there is the route through the importer. Under Article 19, an importer may only place products on the market that comply with the requirements. It therefore checks whether the conformity assessment, technical documentation, CE marking and the manufacturer's contact details are in place. If they are missing, it will not buy.

Under Article 20, distributors have similar but somewhat lighter checking obligations. If an importer or distributor learns of a vulnerability, it must inform the manufacturer. Where there is a serious risk, market surveillance can require products to be recalled or withdrawn from the market. For an exporter, this means a problem with one product can hold up an entire shipment in an EU warehouse.

Deadlines

The reporting obligations are already running. If a manufacturer becomes aware of an actively exploited vulnerability in its product, it must submit an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a corrective measure is available. For severe security incidents, the final report is due within one month. Reports go through ENISA's single reporting platform (Art. 16), which has been in operation since September 11, 2026.

What EU customers actually ask for

• An EU declaration of conformity, for all products with digital elements from December 11, 2027.
• The technical documentation, with a risk assessment and a description of the security measures.
• A software bill of materials (SBOM) listing all components and libraries.
• A coordinated vulnerability disclosure (CVD) policy with a contact address for reports.
• A stated support period and proof of how updates are delivered.
• For important or critical products, the result of the required conformity assessment, where applicable a certificate from a notified body.
• For industrial products, often evidence based on the IEC 62443 series of standards.

Many importers and distributors are already asking for this today, even though most obligations do not apply until the end of 2027. They do not want stock in their warehouse that they will no longer be allowed to sell.

Large buyers are also writing the requirements into their purchasing terms: assurance of CRA conformity from a set date, reporting of vulnerabilities to the customer, provision of updates for an agreed minimum period, and liability for recalls. Read these clauses carefully before you sign supply contracts that run beyond 2027.

First steps

1. Make a list of all products you supply to the EU that contain software or can be connected.
2. Check for each product whether it falls into the classes of important or critical products (Annexes III and IV).
3. Set up a reporting process right away: who takes in reports of vulnerabilities, who assesses them, who reports within 24 hours?
4. Generate an SBOM for each product version. Many build tools can do this automatically.
5. Check which of your systems can be reached from the internet, such as update servers and remote maintenance access. Tools such as veyrisk show this from the outside.
6. Plan the conformity assessment and documentation so they are finished before December 11, 2027.

The free EU Readiness Check gives you an initial picture.

How it relates to certifications

The CRA does not require any management system certification. An ISO/IEC 27001 certificate does show, however, that your development, your build environment and your incident handling are under control, and it helps with the process requirements. For industrial products, IEC 62443 is widely used. Automotive suppliers usually need TISAX, even though vehicles themselves are not covered by the CRA. Quality management under ISO 9001 makes the documentation easier. For the organizational work around it, a GRC tool such as Sightadel keeps tasks, evidence and document versions together. If you supply products to operators of critical services, NIS2 comes on top, and AI features in products also fall under the AI Act.

For manufacturers from Brazil, where a lot of electronics and automation equipment is made, the CRA is one of the most important new EU rules. The requirements are the same whether the goods go through an importer or straight to an industrial customer.

FAQ