March 2026 – The Cyber Resilience Act (Regulation EU 2024/2847 – CRA) entered into force on 10 December 2024 and introduces a comprehensive cybersecurity framework for products with digital elements placed on the EU market. The Regulation aims to address the insufficient level of cybersecurity in many digital products and the lack of timely security updates provided throughout their lifecycle.
Which products are in scope?
The CRA applies to "products with digital elements", defined as software or hardware products, including their respective remote data processing solutions that can be directly or indirectly connected to a device or a network. Consequently, the CRA applies to both connected hardware products (e.g., smartphones, laptops, smart-home products, smart watches, internet connected toys) as well as microprocessors, firewalls, and smart meter gateways within smart metering systems), as well as software products (e.g., accounting software, computer games, mobile apps).
