Cyber Resilience Act: Are Your Connected Products Ready?

Do you manufacture a connected device, equipment with Bluetooth, Wi-Fi, or LoRa connectivity, or any connected product that includes software? The Cyber Resilience Act (CRA) applies to you. This new European regulation imposes cybersecurity requirements on all products with digital components sold in the European Union. Even a simple network port or USB connection is enough to bring a product under the scope of the CRA. And the timeline is tighter than it seems.

Cyber Resilience Act: Are Your Connected Products Ready?
Two dates to keep in mind

The CRA took effect in December 2024, but its requirements are being phased in.

First milestone, already achieved: September 11, 2026. As of that date, manufacturers must report actively exploited vulnerabilities and serious incidents to the authorities, with an early warning within 24 hours. This requirement also applies to products already on the market.

Phase 2: December 11, 2027. As of that date, all requirements will apply to new products placed on the market (or to products already on the market that have undergone a substantial change): conformity assessment, technical documentation, and CE marking. Fines can reach 15 million euros or 2.5% of global revenue.

Fourteen months may seem like plenty of time. But for a physical product, it isn’t: between the initial idea, prototyping, mass production, and certification, a development cycle often lasts 12 to 18 months. A product whose design begins today will be launched after the deadline. It must therefore be designed to meet compliance standards from day one.

How the CRA Is Changing Design

The regulation does not require adding a layer of security at the end of the project. It requires that cybersecurity be considered from the product’s architectural design phase onward:

  • no known exploitable vulnerabilities at launch, and a secure default configuration;
  • authentication, access control, and encryption of sensitive data;
  • an attack surface reduced to the bare minimum;
  • security updates throughout the product's support period;
  • an inventory of software components (SBOM, or Software Bill of Materials) and a vulnerability management process;
  • Comprehensive technical documentation, retained for several years.

These decisions are made very early on: the choice of microcontroller, key management, the remote update mechanism, and the software libraries used (SBOM). Correcting them later is costly and may even require redesigning the circuit board.

Not all products are in the same boat

Depending on its function, a product falls into a different risk category. Most connected devices fall under the default category, with self-assessment of compliance. More sensitive products, such as certain industrial, security, or network equipment, may require the involvement of a third-party organization. Medical devices, on the other hand, remain subject to the MDR regulation.

Identifying the right category is the first decision to make, as it determines the project's budget and timeline.

Who Does What

 

The manufacturer remains legally responsible for the conformity of its product, including the declaration of conformity, vulnerability management, and communications with the authorities. However, it may delegate some of these tasks through a mandate. The role of an engineering firm is primarily focused on the pre-launch and design phases: integrating security into the electronic and software architecture, and producing the technical documentation that will demonstrate the product’s compliance. The firm may then continue its involvement after the product is placed on the market, monitoring developments and reporting to the authorities on behalf of the manufacturer.

Why Choose Quimesis for Support?

Quimesis designs connected products from start to finish: electronics, firmware, mechanical design, connectivity, and preparation for certification and CE marking. Cybersecurity is a natural part of this process, because it is determined by the same technical decisions as the rest of the product.

Specifically, Quimesis can:

  • analyze your product and determine its category under the CRA;
  • Identify any discrepancies between your current product and the requirements of the regulation;
  • incorporate these requirements into the design of your next product or into the development of an existing product;
  • compile the required technical documentation;
  • be designated as the authorized representative to monitor product vulnerabilities, notify the authorities of actively exploited vulnerabilities and serious incidents, and maintain technical documentation and the declaration of conformity.

Having a single partner for design and compliance prevents back-and-forth communication between teams and avoids unpleasant surprises at the end of the project.

Prevention is cheaper than correction

Will your connected product be launched after December 2027? Let’s talk about it now. Compliance is least expensive during the design phase.

Contact us for a customized compliance analysis

 

Posted on October 26, 2026

See all news