IoT manufacturers in every region have a host of data privacy standards and laws to comply with, and now the EU is adding one more: the Cyber Resilience Act, or CRA. While the CRA has some aspects that are simply common sense and others that overlap with already existing standards, there are some aspects that are new and could present challenges to IoT manufacturers and providers.
So what is the EU Cyber Resilience Act and how will it change the IoT world in the future?
The Basics of the EU Cyber Resilience Act
The CRA lays out several specific goals that the act is intended to fulfill:
- Goal #1: Ensuring fewer vulnerabilities and better protection in IoT devices and products
- Goal #2: Bringing more responsibility for cybersecurity to the manufacturer
- Goal #3: Increasing transparency
Goal #2 leads directly to the obligations laid out for manufacturers:
- Cybersecurity must be an aspect of every step of the device or software development life cycle
- Risks need to be documented
- Manufacturers must report, handle, and patch vulnerabilities for any devices that are sold for the product’s expected lifetime or for five years, whichever comes first
- The manufacturer must provide clear and understandable instructions for any products with digital elements
So to whom does the CRA apply? The answer is anyone who deals in IoT devices, software, manufacturing, development, etc. The standard lays the responsibility for vulnerabilities squarely at the foot of the manufacturers of the IoT device or software product in a way most other standards have yet to stipulate.
However, the CRA does not affect all devices and manufacturers equally. There are three main categories that will dictate how manufacturers apply the standard. The first is the default category, which covers roughly 90 percent of IoT products. Devices and products in this category are non-critical, like smart speakers, non-essential software, etc. The default category doesn’t require a third-party assessment of adherence to the standard, so the category just provides a basis for self-assessment that allows manufacturers to establish best practices for product security.
The second and third categories are Critical Class I and Critical Class II, which apply to roughly 10 percent of IoT products. Class I includes password managers, network interfaces, firewalls, microcontrollers, and more. In other words, the vendors and designers of MCUs and the other components included in Class I will have to comply with all of the requirements for that category. Class II is for operating systems, industrial firewalls, MPUs, etc. Again, that means the vendors who develop these operating systems and microprocessors will need to ensure they meet the specific requirements for Class II. The criteria that divide the classes are based on intended functionality (like whether the software will be used for security/access management), intended use (like whether it is for an industrial environment), and breach or vulnerability likelihood, among other criteria. Both Critical Class categories require a third-party assessment for compliance purposes.
There are penalties for non-compliance, which will include the possibility of a full ban on the problematic product, as well as fines of the higher value between 15 million euros or 2.5 percent of the annual turnover of the offending company.
Is the Cyber Resilience Act Important?
The Cyber Resilience Act is part of a longstanding and ongoing endeavor by EU governing bodies to ensure a deeper level of cybersecurity in the EU. This endeavor is largely in response to a marked increase in ransomware and denial of service attacks since the pandemic and especially since the start of the Russia-Ukraine War. Still, the CRA overlaps with some other standards including the upcoming NIS2 Directive, which is the EU’s blanket cybersecurity legislation. Because of that, it’s easy to think that the CRA doesn’t have much to add, but it actually does.
The Nabto Real Time Communication plaform for IoT
Ready to talk to our IoT experts to see what we can do??
Book a consultation today and get help with tech support, business inquiries, and other IoT queries. We are happy to help. Talk to you soon.
The Cyber Resilience Act is broader than a typical IoT security standard because it also applies to software that is not embedded. That is to say, it applies to the software you might use on your desktop to interact with your IoT device, rather than just applying to the software on the device itself. Since non-embedded software is where many vulnerabilities take place, this is an important change.
A second important change is the requirement for five years of security updates and vulnerability reporting. Few consumers who buy an IoT device expect regular software updates and security patches for that type of time range, but both will be a requirement under the CRA.
The third important point of the standard is the requirement for some sort of reporting and alerting system for vulnerabilities so that consumers can report vulnerabilities, see the status of security and software updates for devices, and be warned of any risks. The CRA also requires that manufacturers notify the European Union Agency for Cybersecurity (ENISA) of a vulnerability within 24 hours of discovery. These requirements are intended to keep consumers’ data safe, but they will also allow manufacturers to avoid costly breaches.
Compliance Preparation for the Cyber Resilience Act
The Cyber Resilience Act is in the early stages yet, and even when it is approved, manufacturers will have two years to comply. So full compliance will probably not be obligatory until 2025 or 2026.
However, that doesn’t mean you shouldn’t start preparing now. When the General Data Protection Regulation (GDPR) came into force in the EU, companies had to make major changes to their operations and the way they handled consumer data, advertising, cookies, and more. The Cyber Resilience Act has the potential to be just as complex and revolutionary in changing the way IoT manufacturers and software providers manage security for their products.
What can manufacturers do now to avoid penalties for non-compliance in the future? For starters, there are already technologies available that can help with CRA compliance. The reporting requirements of the EU Cyber Resilience Act are time-sensitive and penalties for non-compliance are high. This means manufacturers have a vested interest in developing efficient ways to communicate discovered vulnerabilities to both consumers and ENISA, as well as to patch those vulnerabilities as quickly as possible.
As a result, IoT providers who can utilize a P2P IoT communication platform like Nabto Edge that enables remote status reports, updates, and security patches will have a competitive advantage. Additionally, such a platform can allow IoT providers to set up push notifications and security alerts for consumers, enabling the highest level of transparency and communication in case a vulnerability is discovered.
It’s also important to keep up with changes to the proposal as laid out by the European Commission, since the CRA as it appears in 2026 may not be exactly the same as the initial draft of the standard. In fact, well-known companies like Microsoft are already making recommendations and critiques to the EU Cyber Resilience Act proposal.
Many experts believe the CRA is too broad at the moment and too hard to apply, and that it needs stronger definitions, examples, and action plans in order to be truly effective. If these critiques are followed, compliance could become a bit less complex and a bit easier to understand in the future, so it would be wise to keep informed of any changes.
Final Thoughts:
While the initial shift to CRA compliance may be challenging, various technologies and cybersecurity tools are already available to help. Integrating these tools and choosing to pursue the highest levels of security in your IoT products today will put you well on your way to fulfilling the requirements of the EU Cyber Resilience Act before it is even in effect.
Read Our Other Resources
We’ve also published a range of IoT device resources for our community, including:
- Our guide for how you can overcome IoT security and privacy challenges.
- An explanation of some advantages of P2P connectivity for more secure IoT systems.
- Our list of some best practices for IoT data security.
