The short version
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the first EU law that puts mandatory cybersecurity requirements on products with digital elements for their whole lifetime. It is a regulation, not a directive: it applies directly in every Member State, with no national transposition to wait for.
Until now, an embedded device could be sold in the EU with hardcoded credentials, no update mechanism, and no way to report a vulnerability, and be perfectly legal. The Radio Equipment Directive delegated act closed part of that gap for radio products. The CRA closes it for essentially everything with software in it.
The market failure
The CRA's own recitals name two problems:
- Low level of cybersecurity in products with digital elements — insecure defaults, no updates, no vulnerability handling.
- Insufficient understanding and access to information by users, making it impossible to choose secure products or use them securely.
Neither is fixed by the market on its own, because security is invisible at purchase time and the cost of a breach usually lands on someone other than the manufacturer.
What it actually forces you to do
For an embedded product manufacturer, the CRA collapses into four commitments:
- Design and build the product so it meets the essential requirements in Annex I Part I (no known exploitable vulnerabilities at release, secure defaults, confidentiality and integrity protection, minimised attack surface, and more).
- Run a vulnerability handling process for the entire support period (Annex I Part II) — including an SBOM, coordinated disclosure policy, and free security updates.
- Demonstrate conformity through the right assessment route and produce technical documentation, a declaration of conformity, and CE marking.
- Report actively exploited vulnerabilities and severe incidents to ENISA and your national CSIRT within tight deadlines.
Why embedded is the hard case
Web software can ship a fix in an afternoon. An embedded product has constrained flash, a bootloader written years ago, a BSP from a silicon vendor that may be end-of-life, field devices with intermittent connectivity, and a bill of materials full of third-party code nobody has a manifest for. Every CRA obligation is achievable — but only if it is designed in at the silicon and architecture stage, not bolted on before an audit.
That is what the rest of this course is about.