In a century where cybercrimes are rapidly becoming more frequent and harmful, the EU Cyber Resilience Act (CRA) is the latest initiative by the European Union (EU) to improve
standards and accountability for digital products and software marketed within the EU. First proposed by the European Commission in 2022, the CRA is part of a broader effort to make the
. Adopted by the European Council in October 2024, it aims at making the existing EU cybersecurity legislative framework more coherent and ensuring that products with digital components are made secure throughout the supply chain and their lifecycle.
Ambitious purpose and scope
From
smartphones to
smartwatches and even baby-monitors, the CRA covers a wide range of digital products, including both hardware and software, and aims to address growing cybersecurity risks in connected devices and software products, often termed the
Internet of Things (IoT). These products are frequently vulnerable to cyberattacks due to weak or inconsistent security measures. The CRA applies to manufacturers, importers, and distributors selling digital products in the EU, regardless of their location. Its core requirements include minimum cybersecurity standards to protect against unauthorized access, data breaches, and other vulnerabilities, security updates provided by manufacturers throughout a product’s operational lifespan, regular risk assessments and vulnerability testing to address and reduce potential threats. There is also detailed product documentation and disclosures about security risks, thus enabling consumers to make informed choices.
Challenging implementation
Some concerns have been raised about the complexity and high compliance costs introduced by the CRA, especially for smaller businesses and startups, who may struggle with the requirements of vulnerability testing and reporting. However, the CRA is also expected to drive innovation toward creating secure products, as cybersecurity becomes a fundamental aspect of product quality and a priority for firms earlier in their product development cycle. The future will tell whether the CRA strikes the right balance between security requirements and not stifling innovation within the digital market. The Act nevertheless represents a significant step forward in
holding technology providers accountable for cybersecurity, part of a larger strategy aiming to create a unified and secure digital ecosystem across all industries operating within the EU.
This text provides general information. Statista assumes no
liability for the information given being complete or correct.
Due to varying update cycles, statistics can display more up-to-date
data than referenced in the text.
