Top 5 operational impacts of the CRA

Additional Insights

• Cyber Resilience Act: 101 (Chart)

On 10 Oct. 2024, the Council of the European Union adopted the EU Cyber Resilience Act. The act establishes uniform cybersecurity requirements for products with digital elements across the EU. There are several exclusions, including products already covered by legislation such as medical devices and those developed for national security and defense purposes, among others. Many of the obligations in the CRA fall on manufacturers, although authorized representatives, importers and distributors may also be subject to certain requirements.

As organizations prepare for the CRA's requirements to become fully applicable by December 2027, the IAPP has launched a series exploring its relationship with several EU digital regulations and helping companies understand where CRA compliance aligns with other regulatory requirements and where it may necessitate new processes and programs.

Series Overview

Product cybersecurity as a market-access requirement
This article explains how the EU Cyber Resilience Act makes cybersecurity compliance a prerequisite for placing many connected software and hardware products on the EU market.
View article

Coming soon in series

• Building and sustaining an internal CRA program
• Vulnerability management, supply chain and post-market obligations
• How CRA compliance stacks up against other EU laws
• Enforcement risks and strategic positioning