Cyber Resilience Act and RED: what they require of your devices

Who it applies to

The CRA covers products with digital elements, hardware or software, that connect to another device or to a network, even just over a cable or a service port (Art. 2). Not only IoT products: also a control board on a fieldbus, a charger with a communication interface, a sensor with a USB port.

Obligations fall on manufacturers, importers and distributors. The manufacturer is whoever places the product on the market under their own name, even if a supplier designed it.

Excluded are medical and in-vitro diagnostic devices, type-approved vehicles, certified aviation products, marine equipment, and products developed or modified exclusively for national security or defence. Dual-use and industrial products remain in scope.

RED and EN 18031, until 10 December 2027

Since 1 August 2025, internet-connected radio equipment, equipment processing personal data and equipment handling payments must protect the network, personal data and users against fraud (Art. 3(3)(d), (e), (f) of Directive 2014/53/EU). Conformity is shown with EN 18031-1, -2 and -3.

The standards were published with restrictions: they are not enough, for example, if the user can choose not to set any password, or if a product for children does not ensure parental access control. In those cases a notified body is needed.

The delegated regulation is repealed from 11 December 2027, because from that date the requirements move to the CRA. Radio products placed on the market up to 10 December 2027 remain subject to the RED. Electrical safety, EMC and spectrum use still go through the RED.

What the CRA requires

Annex I lists the essential requirements. For the product:

• no known exploitable vulnerabilities when placed on the market;
• secure-by-default configuration and reset to factory state;
• vulnerabilities fixable through security updates, including automatic ones;
• access control and authentication;
• data protected, including by encryption, at rest and in transit;
• integrity of data, commands, programs and configuration;
• essential functions available even after an attack;
• limited attack surface, including external interfaces;
• logging of security-relevant events;
• secure deletion of data.

For vulnerability handling: an SBOM of software components, prompt fixes, regular security testing, a coordinated vulnerability disclosure policy with a reporting contact, securely distributed updates. Support must last at least five years, or the expected product lifetime if shorter (Art. 13).

Fines reach EUR 15 million or 2.5% of worldwide turnover (Art. 64).

Products you already sell

Products placed on the market before 11 December 2027 fall under the CRA only if they undergo a substantial modification (Art. 69). Reporting obligations, however, apply to all of them from 11 September 2026: an actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours (European Commission).

For long-lifecycle products it pays to plan the next board or firmware revision with the CRA requirements in mind.

Machinery Regulation: protection against corruption

Machine builders also have Regulation (EU) 2023/1230, from 20 January 2027. Annex III, section 1.1.9 requires that connecting another device, including remotely, does not create a hazardous situation; that safety-critical hardware, software and data are protected against accidental or intentional corruption; and that the machine can identify its installed software and record interventions on software and configuration.

It is the same work the CRA needs: signatures, versions, logs, protected service ports. It is worth designing it once for both.

Important and critical products

For most products the manufacturer self-assesses conformity. For the categories in Annexes III and IV the procedure is heavier: harmonised standards or a notified body. They include boot managers and operating systems, routers and network interfaces, smart home products with security functions, access control readers, microcontrollers with security-related functions, secure elements and smartcards.

The CRA harmonised standards (EN 40000 series) are in preparation. As of October 2026 none has been published in the Official Journal.