The European Union is rolling out new cybersecurity requirements for hardware and software products sold in the EU market. Aimed at ensuring that all products “with digital elements” are safe from cyber threats, the Cyber Resilience Act (CRA) has implications for the manufacturers of everything from smartwatches and smartphones to data center and industrial equipment — and for the producers of all the software that runs on these devices.
The CRA applies to all products that include a digital component that are made available for sale to customers in the region, whether those products are made by the companies themselves or are part of a bigger distribution chain. Among other requirements, the CRA forces any manufacturer to design their products so that they can be updated if and when a security issue is discovered.
Many developers outside the EU are not familiar with this regulation. Yet not understanding what it covers could lead to sales being blocked or to potential fines. The deadline is also closer than you might think — while the full Act comes into force in December 2027, the first reporting requirements began in September 2026.
Products must meet 13 guidelines
Under the CRA, all products with a software component will have to meet 13 guidelines. These cover a range of requirements on how they handle any data that is created during use, how that data is kept private, and security for the software itself. The product itself should be resilient and with a limited attack service. This includes standard best practices like ensuring that the default configuration for any product is secure, that unauthorized access is not possible, and that data is held securely. Most importantly, the software implemented on any device should be capable of being updated to a more secure version.
The rules also cover the data itself and how it can be managed over time. For example, if the customer wants to delete their data from a device, they should be able to do so. Similarly, they should be able to copy or move their data off the product, rather than being locked into that service. Companies also are encouraged to avoid capturing data that they don’t need to provide the service. The biggest hurdle for software teams is that their products should launch without any known vulnerabilities. While there may be something in the product that is faulty and discovered later, a clean software bill of materials will be essential.
What software providers are responsible for
The software bill of materials, or SBOM, is a list of all the components and code libraries that an application relies on to function. For the regulator, that list will prove that you have checked everything that is in place and whether it is secure at release.
One element that has been problematic for developers — both those who build software, and those who use third-party projects in their applications — is how the European Union approached open source software. To start with, the EU treated all software equally. If you made software with a fault in it, then you were responsible for fixing it. While that approach works appropriately for proprietary software with a paid software license, it does not cover all kinds of software. For shareware or open source software that is licensed for free use without any kind of guarantee, the CRA rules were a huge threat. It would have treated the stereotypical open source developer based in Nebraska working on a small but vital component in the same way as a company with a development budget of billions.
The open source community responded to educate the team putting together the CRA, and a compromise was reached. Commercial open source projects are responsible for making fixes to the projects that they support, while those free open source projects continue with their previous approach. The lobbying effort also brought in the concept of the “Open Source Steward”, representing the efforts that open source foundations have put in to support those projects but where they are not economically or financially liable. The changes brought in allow the CRA to hold companies accountable while avoiding the huge penalties that could have affected individual developers.
Time to put the proper security processes in place
For those developing software and applications as part of digital products, the CRA will enforce more security and compliance rules to follow. It was designed to encourage companies to think about security by design right from the start, as well as ensuring that their products can be updated if and when necessary. The data on those products also has to be kept secure against unauthorized access, while still letting users move or remove their data when needed.
While the full deadline is still more than a year away, teams need to have effective processes in place to alert their relevant authority contacts around potential problems. No software is perfect, but getting the processes in place to keep that software secure and up to date can be achieved. You also must secure the data that you create as part of your product or service, and ensure that you have the right approaches in place to manage that data over time.
—
New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.