Cybersecurity is no longer optional — it is becoming a
legal requirement for products. The EU Cyber Resilience Act (the
"CRA") is a product security regulation
that entered into force on 10 December 2024, and it sets a security
baseline for products with digital elements, meaning software and
hardware products that can be connected to the internet or to other
devices. The CRA's broad scope means that nearly every
connected product sold on the EU market is covered by this
regulation. There is still a transition period, but only until
December 2027.
Cybersecurity Is No Longer Optional — It Must Be
Built-In
The goal of the CRA is simple: to make products more secure.
The CRA (Annex I) sets essential cybersecurity requirements for
products, which must be built in to every product, design, and
development process and maintained during the lifetime of the
product. In practice, the CRA is an extension of the existing CE
mark that already appears on many products. As
