The EU Cyber Resilience Act (CRA) makes cybersecurity a prerequisite for access to the EU market, not only for hardware products with digital elements, but also for software placed on the market independently.
Its core requirements are far-reaching: conformity assessments, European Conformity (CE) marking, and a duty to supply security updates free of charge throughout a defined support period.
The CRA applies to what it calls “products with digital elements.”
This broad scope of application is intentional: The European Commission describes the CRA as a horizontal framework covering hardware and software products made available on the EU market.
Once relevant harmonized European standards are available, manufacturers may use them to benefit from a presumption of conformity with the relevant CRA requirements.