On March 3, 2026, the European Commission published draft guidance on the Cyber Resilience Act (CRA), which is open to public consultation until March 31, 2026. The CRA sets strict cybersecurity requirements for products with digital elements (with limited exceptions, such as medical devices). Its objective is clear: ensuring that such products, when placed or made available on the market, are secure by design and by default and, and remain secure throughout their lifecycle (Please see our full analysis of the CRA here.)
The publication of the European Commission's draft guidance serves as a timely reminder of the rapidly approaching compliance deadlines under this landmark regulation, and the ongoing public consultation provides an opportunity for manufacturers, importers, and distributors to clarify grey areas, shape implementation, and begin preparing for compliance.
