👓This Month's Thematic Dossier: The EU Cyber Resilience Act (CRA), at a glance (for product and security leaders)

Bonjour ☕

This month’s dossier synthesises the most important provisions of the EU Cyber Resilience Act (CRA) for CEOs, CISOs, CTOs, legal directors, regulatory compliance officers and product managers operating in the EU/EEA market. It focuses on scope, definitions of covered products, criticality levels, essential cybersecurity requirements, conformity assessment approaches, key dates, oversight and sanctions. If you place products with digital elements on the EU market—or supply into the EU from abroad—this is for you.

What leaders will learn

• Scope and definitions: what counts as a “product with digital elements” and which exclusions apply.

• Criticality levels and categories that drive obligations.

• Essential cybersecurity requirements and expected outcomes across the lifecycle.

• Conformity assessment routes and documentation at a glance.

• Timelines, application milestones and transition considerations.

• Oversight, market surveillance and penalties for non‑compliance.

Three focus sections inside the briefing

• Why the CRA is product legislation under the European New Legislative Framework (NLF).

• What manufacturers, importers and distributors must do.

• How existing security standards can assist implementation.

Who this is for

• Product and engineering leaders building connected hardware and software.

• Security and compliance leaders responsible for secure development and incident handling.

• Legal and regulatory teams planning CE‑marking and market access strategies.

• Non‑EU vendors supplying products with digital elements into the EU/EEA.

FAQ

• What is the Cyber Resilience Act? An EU law setting horizontal cybersecurity requirements for products with digital elements placed on the EU market.

• Who is in scope? Economic operators, including manufacturers, importers and distributors of covered products, have obligations that vary by role and product category.

• How does conformity assessment work? Different routes apply depending on criticality and category; the briefing outlines the main approaches and documentation.

• When do obligations begin? Application is phased. The briefing summarises key milestones to support planning and resourcing.

• What are the penalties? Administrative fines and enforcement by market surveillance authorities; the briefing covers ranges and triggers.

• How does this relate to the UK? The UK has distinct rules (e.g., PSTI Act for consumer connectable products). The CRA is an EU/EEA framework.

Get the premium CRA briefing

Turn regulatory requirements into a practical plan: understand your current scope, map obligations by product category, select the correct conformity assessment path, and align your teams.