{"id":73417,"date":"2026-08-05T22:34:35","date_gmt":"2026-08-05T20:34:35","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73417"},"modified":"2026-08-05T22:34:35","modified_gmt":"2026-08-05T20:34:35","slug":"cyber-resilience-act-umsetzung","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/cybersecurity-resilienz\/cyber-resilience-act-umsetzung\/","title":{"rendered":"Implement the Cyber Resilience Act in practice"},"content":{"rendered":"
\"Cybersecurity<\/span>

\u2190 Cybersecurity & Resilience<\/a><\/p>

Implement the Cyber Resilience Act in practice<\/h1>

Organize and document cybersecurity for products with digital elements throughout their entire life cycle.<\/strong><\/p><\/div><\/div>\n\n\n\n

The Cyber Resilience Act (CRA) applies to products with digital elements made available on the EU market and to the relevant economic operators. Manufacturers must manage cybersecurity from planning and development through to maintenance and vulnerability handling. The Regulation has applied since 10 December 2024; notification provisions since 11 June 2026, Article 14 reporting obligations from 11 September 2026 and the remainder of the Regulation from 11 December 2027.<\/p>\n<\/div>\n\n\n

Background<\/h2>\n\n
\"Cybersecurity<\/figure>
\n

Software and connected products often consist of proprietary components, open source libraries, third-party services and multiple release variants. Without a clear product inventory, responsibilities and a maintained vulnerability routine, it remains unclear what has been shipped, what support a product receives and how security vulnerabilities are responded to.<\/p>\n<\/div><\/div>\n\n\n\n

The CRA is therefore shifting the focus from selective security checks to a verifiable product life cycle. He doesn't require every team to use the same tools. It is crucial that the appropriate cybersecurity requirements are implemented on a risk-based basis, documented and maintained during the support period.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n

Regulation (EU) 2024\/2847 is a horizontal EU legal framework for hardware and software products with digital elements made available in the context of a commercial activity on the Union market. End products, separately provided components and certain associated remote data processing solutions may be covered. Exceptions and the exact role \u2013 such as manufacturer, importer or dealer \u2013 must be legally examined on a case-by-case basis.<\/p>\n\n\n\n

The main obligations apply to manufacturers who place a product on the market under their name or brand. They must, among other things, carry out a cybersecurity risk assessment, take into account essential requirements of Annex I, prepare technical documentation and carry out the appropriate pre-market conformity assessment procedure. After a successful assessment, the EU declaration of conformity and CE marking follow.<\/p>\n\n\n\n

The CRA entered into force on 10 December 2024. Provisions on the notification of conformity assessment bodies have applied since 11 June 2026; the Article 14 reporting obligations for actively exploited vulnerabilities and severe security incidents apply from 11 September 2026. The remaining principal obligations apply from 11 December 2027. The non-binding Commission guidelines of 27 July 2026 explain matters including scope, remote data processing, open source, support periods and interaction with other EU law.<\/p>\n\n\n\n

The CRA complements NIS2 but does not replace any organisation-related NIS2 obligations. NIS2 is on the page Implement NIS2 in practice<\/a> treated; the cluster classification provides Cybersecurity & Resilience<\/a>.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n
\"IT-Security-Spezialistin<\/figure>
\n