The EU Cyber Resilience Act: Security by Design Becomes Law

The European Union's Cyber Resilience Act represents a structural shift in how embedded security is treated for connected products entering the European market. Where security-by-design was once a best practice organizations could choose to follow, the CRA makes it an enforceable legal requirement for hardware and software manufacturers.

The timeline gives this real urgency. Vulnerability reporting obligations begin in September 2026, with the full set of compliance requirements applying by the end of 2027. For manufacturers of connected devices, that makes 2026 the year to operationalize compliance, not the year to start planning it.

In practice, this means building vulnerability disclosure processes, committing to ongoing patch support for the lifetime a product is expected to be in use, and documenting security decisions throughout the development lifecycle rather than treating security as an afterthought before shipping.

The CRA is part of a broader global pattern. Alongside expanding US state privacy laws and evolving frameworks elsewhere, regulators worldwide are moving from voluntary guidance toward enforceable, specific cybersecurity obligations with real penalties attached.

•        Map which of your products fall within CRA scope and assess current compliance gaps

•        Build vulnerability disclosure and ongoing patching processes now, ahead of the September 2026 deadline

•        Align product engineering roadmaps with the phased 2026-2027 compliance timeline