Cyber Resilience Act (CRA): are you ready for September 2026?

Cyber Resilience Act (CRA): are you ready for September 2026?

The Cyber Resilience Act (CRA) is the new European regulation coming into force in September 2026. Its goal is to strengthen the cybersecurity of digital products by imposing strict security standards from the design stage and throughout the life cycle. This legislation applies to all products that include code: software, connected objects, IoT devices, equipment with embedded digital systems and any product intended to be sold in the European Union.

The CRA is part of a broader push towards Security by Design and extended responsibility for manufacturers, importers and distributors. It complements and strengthens existing directives, such as the NIS2 directive, by introducing precise requirements on vulnerability management and technical documentation.

Main obligations for manufacturers and distributors

CRA compliance rests on four main pillars:

1. Security built in from the design stage

   The CRA requires cybersecurity to be considered from the very first stages of product design. This includes:

   • Carrying out an initial risk analysis, identifying potential attack vectors and threat scenarios for the product.
   • Adopting secure development practices (Secure Development Lifecycle): access control, encryption, secrets management, security unit and integration tests.
   • Documenting design decisions and the security measures implemented, to demonstrate regulatory compliance.

2. Continuous vulnerability management

   The CRA requires manufacturers to set up a structured process for detecting, assessing and fixing vulnerabilities throughout the product's life:

   • Active monitoring of published vulnerabilities and security alerts.
   • Prioritizing and quickly handling critical flaws.
   • Notifying end users and competent authorities when necessary.

3. Secure maintenance and updates

   Products must include secure and regular update mechanisms, ensuring that security patches are applied effectively without compromising the integrity or availability of the product:

   • Signed and verified updates.
   • Version management and backward compatibility.
   • Documented deployment and rollback procedures in case of incident.

4. Documentation and traceability

   Each product must have a complete technical file to demonstrate compliance:

   • Description of the product and its software and hardware components.
   • Risk analysis report and security measures applied.
   • Evidence of security tests, audits and any certifications.
   • Vulnerability management process and security-related event logs.

Consequences for companies

Failing to comply with the CRA can lead to significant financial penalties, but also to a major reputational risk. For manufacturers, importers and distributors, it is not only a legal obligation but also a strategic issue:

• Securing the trust of customers and partners.
• Preventing compromise risks and the exploitation of vulnerabilities.
• Building robust and repeatable internal cybersecurity processes.

Companies must therefore start preparing for compliance today, by aligning their development, maintenance and reporting practices with CRA requirements.

How to prepare technically

To prepare effectively, the following steps are recommended:

1. Mapping products and software components: Identify all products in scope, along with software dependencies and third-party libraries, to assess the exposure to vulnerabilities.

2. Formal risk analysis: Set up a consistent risk assessment methodology based on standards such as ISO 27001, IEC 62443 or the OWASP IoT Top Ten.

3. Setting up a vulnerability management process: Centralize the detection, assessment and remediation of vulnerabilities. Define key performance indicators (KPIs) and an update schedule.

4. Structuring technical documentation: Create technical files that meet CRA requirements, including security evidence, audit reports, test plans and update procedures.

5. Training and raising team awareness: Train development, support and sales teams on CRA requirements and cybersecurity practices, to ensure compliance across all internal processes.

How DVID helps

At DVID, we help companies understand and concretely apply the CRA.

Our approach combines technical expertise and pragmatism:

• Translating the regulation into understandable examples (technical examples of secure CRA implementations, examples of evidence to provide…).
• Hands-on technical practice (secure updates, data encryption…).
• Empowering the teams in charge of implementing the CRA.

We help our customers turn the CRA into a driver of trust and security for their products, avoiding unnecessary complexity and ensuring effective compliance.

The CRA is coming fast. For the companies concerned, anticipation is key: it is better to structure your practices today than to suffer the constraints tomorrow.

Learn more: https://dvid.eu

Contact us: https://dvid.eu/#contact

Follow our news: https://www.linkedin.com/company/dvid/