A: The Cyber Resilience Act applies to products with digital elements placed on the EU market. This includes hardware, software, and firmware that connect to a network, process data, or can be updated. During our readiness call, we assess applicability based on your product architecture and delivery model.

A: Yes, in many cases. Software that is placed on the EU market, whether standalone or delivered with hardware, may fall under the Cyber Resilience Act depending on its function and use. Applicability must be assessed case by case.

A: No. While there are overlaps in secure-by-design principles, CRA and RED cybersecurity are separate regulations with different scopes. CRA introduces broader lifecycle, vulnerability handling, and reporting obligations that are not fully covered by RED compliance.

A: This depends on the classification and risk profile of your product. Many products can follow self-assessment routes, while others may require third-party involvement. We help determine the correct conformity approach for your specific case.

A: Manufacturers must prepare technical documentation and compliance evidence demonstrating how CRA cybersecurity requirements are met. This includes design decisions, security measures, vulnerability handling processes, and lifecycle considerations.

A: Certain vulnerability handling and reporting obligations apply before full CRA enforcement. This means manufacturers should establish processes early to avoid compliance and liability risks.