The Cyber Resilience Act Comes Into Force - Act Now

The EU's IT security offensive has been given a new building block: On December 10, 2024, the EU Cyber Resilience Act ("CRA") came into force. The EU regulation contains strict requirements for the cyber security of networked products and software, which will apply until December 11, 2027. They pose challenges for companies that must already be taken into account in the design and development phase of products. Companies should therefore use the transition period to prepare for the CRA and avoid strict regulatory sanctions (such as product recall orders in the worst case).

Background and scope of application

The Cyber Resilience Act (CRA) is part of the EU's "Digital Decade" initiative to promote digital transformation. Alongside DORA and NIS2, the CRA represents a third major pillar in the area of cyber security. While DORA and NIS2 aim to strengthen the cyber resilience of a company's internal IT infrastructure, the CRA places requirements on the cyber