The EU Cyber Resilience Act

On 20 November 2024, the European Commission adopted the Cyber Resilience Act (2024/2847) (the CRA). The CRA seeks to create a unified framework for mandatory cybersecurity standards across the EU, requiring compliance from economic operators of products with digital elements. The CRA will come into force on 11 December 2024 and will apply directly across all EU Member States.

Objectives

The CRA sets forth mandatory cybersecurity requirements for products with digital elements offered within the EU market. Its overarching goals are to (i) enhance the cybersecurity of digital products, (ii) protect consumers and businesses against the risks posed by inadequate cybersecurity measures, (iii) encourage manufacturers to integrate security by design across the digital product lifecycle; and (iv) complement existing cybersecurity regulations, such as the NIS2 Directive and the Digital Operational Resilience Act (the DORA).