With the Cyber Resilience Act (CRA), the EU has adopted comprehensive regulation to improve the cyber resilience of – with a few exceptions – all IT products with connectivity distributed within the EU. This regulation will already take effect on September 11, 2026: From this deadline, manufacturers must report actively exploited vulnerabilities and serious security incidents to the competent authorities within 24 hours. All other requirements must be met from December 2027.
Market Access Only with Conformity Certificate
Compliance with the Essential Security Requirements of the CRA is a prerequisite for market access for the affected products. Depending on which CRA product group (i.e., Default Class, Class I, Class II, or Critical Class) the manufacturer’s products fall into, a self-declaration may be sufficient to prove compliance with the requirements, or a product-specific type examination or EUCC certification must be carried out. Likewise, the manufacturer can undergo a qualification procedure, which automatically confirms conformity for its products (not applicable for Critical Class).
SRC Initiates Notification Procedure with BSI
SRC Zert and the SRC testing body took the first steps in July with the notifying authority for Germany, the Federal Office for Information Security (BSI), to be able to offer our customers necessary conformity assessment services related to the Cyber Resilience Act in the future. An information meeting addressed the scope of the notification and the necessary accreditation with the German Accreditation Body (DAkkS). SRC is now taking the next steps towards notification.
Now is the Right Time to Start
Even if all details for the implementation of the Cyber Resilience Act are not expected until the end of this year, now is the right time for all affected manufacturers to address the CRA. SRC already supports with the classification of products into CRA classes, with preliminary checks for CRA compliance, with the creation of a manufacturer’s declaration according to Module A, and with evaluations according to EUCC.
Start the classification process here.
