Exciting news from the European Union Council as they have officially adopted the Cyber Resilience Act (CRA), a game-changing regulation that will introduce EU-wide cybersecurity requirements for products with digital elements.

Whether you’re using smart doorbells, speakers, or baby monitors, this regulation will apply to all products that are connected either directly or indirectly to another device or network.

The main goal of the CRA is to bring clarity and consistency to the existing cybersecurity legislative framework. This means ensuring that products with digital components, like Internet of Things (IoT) devices, are secure throughout their supply chain and lifecycle.

Under this new regulation, requirements will cover the design, development, production, and market availability of both hardware and software products. This helps avoid conflicting requirements across different EU member states, creating a harmonized approach to cybersecurity.

To demonstrate compliance with the CRA, software and hardware products will bear the CE marking. This well-known mark indicates that the products meet high safety, health, and environmental protection standards, providing consumers with peace of mind.

Exceptions to these requirements will be made for products already covered by existing EU laws, such as medical devices, aeronautical products, and cards.

Notably, in the UK, a similar law known as the Product Security and Telecommunications Infrastructure (PSTI) Act came into effect in April 2024.

What’s Next for the Cyber Resilience Act?

After being adopted, the CRA will be signed by the presidents of the Council and the European Parliament before being published in the EU’s official journal in the coming weeks.

Once published, the regulation will enter into force twenty days later and will be fully implemented 36 months after that, with some provisions coming into effect sooner.