Cyber Resilience Act – how the new regulation affects your business

CRA becomes part of CE marking

The CRA was adopted in December 2024 and will be phased in from September 2026. By the end of 2027, the CRA is expected to be fully rolled out. Unlike many other regulations and directives passed by the EU, CRA has no direct predecessor. The regulation has been developed to complement other cybersecurity regulations, such as NIS2, which places requirements on organisations rather than products.

The requirements will be incorporated into the CE marking, which in practice means that cybersecurity will go from being a "nice to have" to mandatory if you want to continue selling your connected product on the EU market.

Built-in security central to CRA

Security by Design, or built-in security, is a central part of the regulation. It is no longer acceptable to add security after the fact; instead, requirements are now imposed throughout the entire development phase and until the end of the life cycle.

"Most people probably associate the term 'life cycle perspective' with the environment and climate, but here we are talking about the life cycle of software. It extends from the initial idea and risk analysis to requirements specification, design, architecture, development and testing. Once the software has been released on the market, it is a question of maintenance and updates. We talk about End of Support, when the manufacturer stops sending out updates and no longer takes responsibility for security", explains Ted Strandberg.

Standards as tools for regulatory compliance

Ted Strandberg heads the national working group in Sweden that develops standards related to cybersecurity in products. By testing products against established standards, such as IT security in industrial automation systems (EN IEC 62443), it is possible to assess whether a product with digital elements meets basic cybersecurity requirements. Standards can be used as support to demonstrate compliance with CRA. For certain products classified as high risk – such as operating systems or central system components – CRA also introduces a certification requirement.

CRA compliance extra important for subcontractors

Proof of CRA compliance in the form of an accredited report is particularly important for subcontractors who want to maintain and strengthen their competitiveness. A subcontractor who cannot guarantee the safety of their components will be ruled out as an option for customers who market the finished product. Quite simply, there is too much at stake.

"Violating the rules can result in very high fines. Seeking assistance from RISE means sharing that risk. If your product has not been reviewed by a third party, you bear the risk of being penalised. If we make a mistake in the review, we also bear responsibility", explains Ted Strandberg.

CRA training provides a solid knowledge base

Before product testing, certification processes or other technical measures, knowledge building comes first. With the right knowledge, it becomes much easier to tackle CRA.

"One way to build that knowledge is to take a course with us. We offer company-specific courses that provide a solid foundation. For many players, the transition to CRA compliance will take time, so it's important not to wait too long to get started," says Ted Strandberg.