EU Cyber Resilience: Important Information About Authorised Representatives and Digital Product Compliance

The European Union’s Cyber Resilience Act (CRA) is set to enforce stricter cybersecurity standards across digital products. The regulation officially took effect on December 10, 2024, with its main provisions becoming fully applicable from December 11, 2027.

What the Cyber Resilience Act Covers

The CRA introduces mandatory cybersecurity requirements for products that include digital elements, covering both hardware and software. This applies to a wide range of devices, from smart home gadgets like cameras and thermostats to industrial control systems. However, some products already regulated under other EU laws, such as medical devices and automobiles, are excluded.

The Act aims to address cybersecurity vulnerabilities by ensuring that manufacturers provide regular security updates and design their products with security in mind. The goal is to create a safer digital environment, protecting both businesses and consumers from cyber threats.

Who is Affected and What They Must Do

The CRA impacts several key groups:

• Manufacturers must ensure their products are secure by design, free from known vulnerabilities at launch, and configured with security settings as the default. They must also provide regular updates and report any security flaws they fix.
• Importers and Distributors need to verify that products meet CRA requirements before they are sold in the EU. They must also ensure products display the CE marking, which signifies compliance with the regulation.
• Users will benefit from clearer information on the cybersecurity features of products, allowing them to make informed decisions when purchasing digital goods.

Authorised Representative Requirements for Digital Products

For tangible goods, the Authorised Representative’s name and address usually appear on the product itself, the packaging, or in a printed leaflet. But for digital-only offerings like software or mobile apps, the approach is different. In these cases, the representative’s contact information must be clearly available through digital means—such as within the app’s settings, legal or “About” sections, download portal, or within digital user guides or licensing agreements. The aim is to make this information easy for users and regulators to access, helping to demonstrate transparency and compliance with the Cyber Resilience Act.

Steps Digital Businesses Should Take to Meet CRA Obligations

To comply with the Cyber Resilience Act, companies offering digital products should proactively assess their current cybersecurity posture. This includes evaluating how products are developed and identifying any security gaps. Businesses should ensure that secure configurations are used by default and implement structured processes for vulnerability management and timely updates. Training staff on CRA expectations, adopting recognized cybersecurity frameworks, and maintaining well-organized technical records are also key steps. For non-EU manufacturers, working with a qualified Authorised Representative and possibly engaging a specialist in CRA compliance can help avoid penalties and streamline the path to conformance.

Compliance Timeline and Penalties

The CRA has a phased implementation timeline:

• By June 2026, bodies responsible for assessing compliance must be notified.
• By September 2026, manufacturers must start reporting security vulnerabilities and incidents.
• By December 2027, all products must fully comply with the CRA’s cybersecurity standards.

Failure to comply with the CRA can result in severe penalties, including fines of up to €15 million or 2.5% of a company’s global annual revenue, whichever is higher.

With the deadline approaching, businesses in the digital products sector must prioritize cybersecurity to ensure compliance and avoid penalties.