Cyber Resilience Act, Part 1: The first deadlines are approaching Reporting starts in 2026. By end-2027, cybersecurity is required for CE conformity. What embedded and IoT manufacturers must know now. With the Cyber Resilience Act (CRA), or Regulation (EU) 2024/2847, the EU is establishing a binding legal framework for the cybersecurity of products with digital elements for the first time. For manufacturers, importers, and distributors, this represents a fundamental shift: cybersecurity will no longer be merely an IT issue but a verifiable product characteristic – comparable to functional safety, EMC (Electromagnetic Compatibility), or electrical safety. Embedded and IoT products containing software or connected to networks are particularly affected. In a three-part article series, eeNews examines various aspects of the CRA and, in particular, how companies should now proceed. eeNews, together with Lemberg Solutions, is also organizing the free webinar “Building CRA-ready IoT products: the practical side of compliance” on 10 September, 2026. This webinar will show what a CRA-compliant SDLC looks like in practice. Registration for the webinar is now open. Why the CRA is changing the rules of the game The Cyber Resilience Act was adopted in December 2024 and will become fully mandatory by the end of 2027 at the latest. It applies to virtually every electronic product that contains software or can be connected – directly or indirectly – to a network. This encompasses connected software and cloud applications, as well as smart home sensors, gateways, and even complex industrial embedded systems. For developers, manufacturers, and integrators, this represents a paradigm shift. In the future, it will no longer suffice to develop a product that is merely functionally safe and market-ready; companies must be able to demonstrate that cybersecurity was taken into account throughout the design, development, delivery, and maintenance phases. From organizational security to product security