EU Cyber Resilience Act published

The EU Cyber Resilience Act (CRA) was published today. This establishes its validity and timetable, as the publication date determines the corresponding implementation dates: The start of actual validity – i.e. the date from which every software manufacturer or representative of such a manufacturer who places software on the market in the EU must be compliant – is December 11, 2027.

More precisely: The regulations, in particular Art. 13 and Annexes I and II, apply to all products with digital elements that are placed on the EU market from this date. For products that are placed or have been placed on the market beforethis date, the requirements apply as soon as they undergo significant changes after this date, see Art. 69 II CRA. However, the reporting requirements under Art. 14 must be met for all products from September 11, 2026, regardless of the date of market entry (Art. 69 III CRA).

From now on, there is a transitional period until which software providers must deal with the new requirements and implement them. Implementation is not trivial in some cases and requires some organizational change, e.g. the inclusion of any risk analyses and assessments that may not yet exist in the release process, the declaration of support periods or the establishment of suitable vulnerability management processes.

– Unless otherwise stated, all references in the following refer to the text of the CRA –

For whom is the Cyber Resilience Act relevant?

In principle, the CRA applies to anyone who provides a product with digital elements, i.e. software support. However, it also restricts its application to groups that are already regulated elsewhere. For example, products that are only used in the automotive, marine or aviation sectors or are subject to the Medical Device Regulation are excluded. However, it can be assumed that a dual-use option, i.e. usability in other, non-regulated areas, will also restore validity.

Roles of the actors

The role of the actor is also relevant for the assessment of validity. Conceptually, regulation attempts to make the beneficiary of the economic transaction responsible for the transaction within the EU. What does this mean?

In a simple case, a European provider manufactures a product with digital elements that falls within the regulated area (see above). This means that the supplier is directly obliged to fulfill the CRA requirements for its product, for example a manufacturer of stereo systems or jukeboxes that support music streaming or a machine tool that can be maintained remotely.

If the manufacturer of the product is based outside the EU, these obligations are transferred to its representative, the “distributor”. This can be a dealer, a partner or an implementation partner, i.e. the next economic beneficiary. It is interesting to note that the distributor must also vouch for compliance with the obligations during production. This brings with it a completely new liability regime for license sellers of American software, for example!

Open Source

As soon as open source comes into play, the chain becomes somewhat less clear. But the CRA knows and takes into account the open source concept. The actual creator of an open source solution is not subject to the requirements. However, if an actor takes an open source solution and uses it commercially, be it through support contracts, he is subject to the regulations analogous to those of a provider. For example, a SUSE is responsible under the CRA for the distribution it provides.

There are only exceptions for so-called stewards. These have to fulfill less stringent requirements. This role was created for the so-called Foundations (Eclipse, Cloud native, etc.), as they represent a form of distributor, but do not derive any economic benefits from the provision and distribution comparable to those of a conventional software provider. Recognition is required to be considered a steward.

What are the major changes?

The guiding idea behind the CRA is to improve the security situation for software consumers. Since almost everything today is controlled by and equipped with software, cyber attacks became possible almost everywhere. Every component that is connected to the Internet, Wi-Fi or even near-field communication such as ZigBee or Bluetooth is a potential attack surface and must therefore be used or provided with caution.

The provider of software on the European market must therefore fulfill the following requirements in future:

• Provision of a software bill of materials (SBOM), see Annex I
• Regularly carry out a risk assessment of the safety risks and include this in the documentation, see Art. 13, III and IV
• Drawing up a declaration of conformity, see Art. 13 XII and Art. 28 I and Annex IV
• Provision of a CE marking, see Art. 12 XII and Art. 30 I
• Definition of an expected lifetime of the product and the provision of free safety updates within this period, see Art. 13 VIII et seq.
• Demanding extensive reporting obligations (in accordance with Art. 14)
  • Notification of actively exploited vulnerabilities within 24 hours to the European Network and Information Security Agency (ENISA) via a reporting platform yet to be created (presumably analogous to the solution already in place in the telecom environment)
  • In addition, clarification of the assessment and measures within 72 hours
  • Information of the users of the product and the measures to be taken by them, see Art. 14 VIII.

What are the consequences of non-compliance?

Every law is initially just a declaration of a behavioral requirement. But what are the consequences if you do not comply? What risks do providers face?

With publication, the member states are instructed to appoint a body that is responsible for supervision in the respective country. In Germany, this will most likely be the BSI. In turn, the BSI can then carry out or commission corresponding inspections in the event of suspicion. If deficiencies are identified, this usually leads to a request for rectification, but can also be sanctioned accordingly. The CRA provides for the following possible sanctions:

• Up to EUR 15 million or, in the case of companies, up to 2.5% of global annual turnover in the previous financial year in the event of a breach of essential safety requirements (Annex I). (see Art. 64 II)
• For breach of obligations imposed by the CRA, up to EUR 10 million or – for companies – up to 2% of the ww turnover (previous year) (see Art. 64 III)
• For incorrect, incomplete or misleading reports to the authorities, up to EUR 5 million or 1% of annual turnover for companies (see Art. 64 IV)

In addition, there is the possibility of restricting the distribution of the product or withdrawing it from the market in the event of sustained non-compliance, see e.g. Art. 58 II.