The EU Cyber Resilience Act (Regulation (EU) 2024/2847) mandates security requirements for every connected product sold in the EU. Mikronexis helps embedded product companies achieve compliance — from gap assessment through to complete CRA technical file.
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the EU's first mandatory cybersecurity law covering all "products with digital elements" — hardware and software with intended or foreseeable network connectivity.
Unlike voluntary frameworks, the CRA is a legal obligation. It establishes essential security requirements that must be met before placing a product on the EU market. Non-compliant products cannot obtain CE marking — meaning they cannot be legally sold in any EU member state. It also introduces ongoing obligations: manufacturers must actively manage vulnerabilities, maintain a Software Bill of Materials (SBOM), and report actively exploited incidents to ENISA within 24 hours of discovery.
Products must be designed with security as a core requirement — not added retrospectively. Default configurations must be secure out of the box.
Manufacturers must have coordinated vulnerability disclosure processes and deliver security updates for the expected product lifetime (minimum 5 years).
A Software Bill of Materials must be maintained. Full technical documentation covering security architecture, threat model, and test evidence is required for conformity assessment.
Actively exploited vulnerabilities must be reported to ENISA within 24 hours of awareness, with a full report within 72 hours.
The CRA classifies products into four categories based on cybersecurity risk. Your class determines the conformity assessment route required.
The majority of connected products. Manufacturers can self-declare conformity using internal processes aligned to CRA essential requirements.
Products where a breach could have significant impact. Conformity requires either applying a harmonised standard (e.g. EN 18031) or third-party evaluation.
Products with high systemic risk. Only a notified body third-party assessment satisfies the conformity requirement — self-declaration is not permitted.
Highest-risk products. Must comply with a European cybersecurity certification scheme under the EU Cybersecurity Act (ENISA).
The CRA mandates essential requirements. Harmonised standards define how to meet them technically.
The CRA establishes essential security requirements that all products with digital elements must meet before CE marking. These requirements are not guidance — they are legal obligations enforceable by market surveillance authorities in each member state. Non-compliance can result in market withdrawal, fines, and liability.
The EN 18031 series is the key harmonised standard family developed to give manufacturers a defined technical path to CRA conformity. Applying EN 18031 creates a presumption of conformity with the corresponding CRA essential requirements — meaning manufacturers who fully implement the standard can self-declare compliance (for default and Class I products) without requiring individual regulatory interpretation of each requirement.
Security baseline for all internet-connected radio equipment and IoT devices. Covers authentication, access control, data protection, and update mechanisms.
Extended requirements for devices with direct internet connectivity, covering network-level attack surface management and remote access security.
Security requirements specific to wearable and personal-use connected devices, with additional considerations for personal data handling.
Requirements for user authentication, administrative access protection, and credential management — no default credentials permissible.
Cryptographic requirements for protecting sensitive data — encryption standards, key management, and integrity verification mechanisms.
Technical requirements for OTA and physical update processes — signed firmware, rollback protection, atomic update procedures, and update integrity verification.
A clear, structured path from your current state to a CRA-compliant product — with full documentation and evidence at every step.
We review your product's current security posture against CRA essential requirements and EN 18031 controls — identifying every gap and scoring priority by risk and enforcement dependency.
Systematic threat analysis of your product's architecture using the STRIDE methodology — identifying all realistic attack vectors, threat actors, and the impact of each successful attack.
Security controls are designed into the product architecture — secure boot chain, hardware security (TPM/SE), encrypted storage, minimal attack surface, and segmented communication channels.
Implementation of all security controls — secure boot, code signing, OTA update verification, key management, runtime protections (stack canaries, ASLR where applicable), and hardened network stack.
End-to-end security validation — vulnerability scanning, fuzzing of communication interfaces, authentication bypass testing, and targeted penetration testing against the threat model attack vectors.
Complete CRA technical documentation package — security assessment, EN 18031 conformity evidence, SBOM, vulnerability disclosure policy, security update commitment, and Declaration of Conformity.
Any company placing a connected product on the EU market. These sectors are most directly impacted by the CRA's scope.
Hardware startups and product companies building connected embedded devices — from prototype to mass market. CRA compliance is required for EU market access.
Industrial controllers, PLCs, SCADA interfaces, and condition monitoring systems connected to OT/IT networks. Often Class I or Class II products under CRA.
Connected home devices, wearables, and consumer electronics. Typically default class — self-assessment permitted but requires proper security design and documentation.
Connected diagnostic devices, remote monitoring equipment, and clinical IoT. CRA overlaps with MDR obligations — dual compliance pathway planning is essential.
Connected vehicle components, telematics units, and fleet management devices. CRA applies alongside UN R155 for automotive cybersecurity — coordinated compliance required.
Smart meters, grid monitoring systems, EV charging infrastructure, and renewable energy controllers. Critical infrastructure context often places these in Class II or Critical.
Security-aligned development applied to shipped embedded products.
Customer-facing IoT devices with mobile app connectivity, cloud data sync, and firmware update capability. Designed with security-first architecture — secure communication, authenticated updates, minimal attack surface, and no hardcoded credentials. Live on the App Store. The type of connected product the CRA directly governs.
Technical and commercial questions about CRA compliance for embedded product companies.
Most connected embedded products have significant CRA gaps — especially around SBOM, OTA update security, and vulnerability disclosure processes. A gap assessment tells you exactly where you stand and what it takes to get compliant before the October 2027 enforcement date.