The recent adoption of the Cyber Resilience Act (CRA) is a crucial step in safeguarding Europe’s digital economy. This new legislation aims to establish essential cybersecurity standards across the European Union, ensuring that the products we use daily are built with security in mind (from the start). But what does this mean for companies, especially small and medium-sized enterprises (SMEs), and why should they care?

What is the Cyber Resilience Act?

The Cyber Resilience Act has been introduced to tackle two major challenges: the low level of cybersecurity in many products with digital components and the inconsistent security updates that make these products vulnerable. Cyberattacks are a growing concern, with the potential cost to the global economy expected to only to rise. These threats aren’t just a financial burden - they put democracy, consumer safety, and public health at risk, making cybersecurity a priority for the EU.

The CRA aims to establish horizontal cybersecurity standards for all products with digital elements, requiring manufacturers to maintain their products securely throughout the entire lifecycle, from design to end-of-life. This regulation will apply to every company - no matter its size - that manufactures, imports, or distributes products with digital elements in the EU market.

Important dates:

• November 20, 2024 - publication in the Official Journal of the European Union (EUR-Lex) as Regulation 2024/2847
• December 10, 2024 - CRA enters into force on the twentieth day after its publication, ensuring a swift transition towards enhanced cybersecurity standards
• September 11, 2026 - Reporting obligations for stakeholders take effect.
• December 11, 2027 - Full application of the regulation

Why Should SMEs Care About the CRA?

For SMEs, the Cyber Resilience Act is more than just a new regulation - it is a wake-up call. SMEs often lack the resources of larger corporations to easily adapt to the new regulations. If SMEs do not comply with the CRA, they risk substantial fines, legal liability, and reputational damage, not to mention the possibility of being barred from selling their products within the EU. Non-compliance is simply not an option if a company wants to remain competitive and trusted by consumers.

In general, the Cyber Resilience Act introduces several key measures that significantly enhance the cybersecurity landscape across Europe:

1. Comprehensive Cybersecurity Requirements

The CRA mandates that all products with digital components - whether hardware, software, or services - must meet specific cybersecurity standards. These standards cover everything from secure product design and development to regular updates and vulnerability management. By implementing these measures, manufacturers will make their products more resilient to emerging threats, ultimately reducing the risk of breaches and vulnerabilities that can affect both businesses and end-users.

2. Mandatory Vulnerability Management

One of the critical requirements of the CRA is that manufacturers must have a vulnerability management process in place. This means ongoing monitoring for security issues, providing patches and updates, and ensuring vulnerabilities are addressed on time.

3. CE Marking as an Assurance of Security

Products must visibly display the CE marking, indicating that they comply with the cybersecurity requirements set out in the CRA. For consumers and businesses alike, this serves as a recognizable assurance that a product has met the safety and security standards required in the EU. This increased transparency (particularly important for SMEs) helps build trust and reduces the uncertainty often associated with digital product purchases.

4. Stricter Compliance for Critical Products

The CRA distinguishes between important and critical products. Critical products, which pose a higher risk if compromised, are subject to more stringent conformity assessments. This differentiation ensures that higher-risk products undergo deeper scrutiny, ultimately improving the resilience of these products against cyber threats. For companies, this means greater protection when dealing with essential digital products that might be fundamental to their operations.

5. Legal and Financial Consequences for Non-Compliance

To ensure that manufacturers take these requirements seriously, the CRA also establishes significant enforcement measures. Non-compliance can result in substantial fines, which underscores the importance of cybersecurity across all digital products. This legal framework pushes companies to prioritize security, which directly benefits users by ensuring they can trust the digital products they use. So yes, the consequences of ignoring the CRA are significant, especially for SMEs.

With connected devices and digital products becoming an integral part of everyday life, the risk of not complying with the CRA is too high for SMEs to ignore. The regulation aims to create a level playing field for all businesses, where consumers can make informed decisions based on the security features of digital products. SMEs that comply will have a competitive advantage, building consumer trust and expanding their market opportunities.

CRACoWi Supporting SMEs with Compliance

This is where the CRACoWi project (Cyber Resilience Act Compliance Wizard) comes in. CRACoWi is designed to support SMEs in adopting the CRA requirements by developing a Compliance Wizard - a digital tool that guides businesses through the CRA’s compliance process step by step. The project is funded under the Digital Europe Program (DEP) and supported by the European Cybersecurity Competence Centre. The project officially started on September 1, 2024. (Read more: CRACoWi Kick Off)

The project focuses on:

1. Compliance Wizard - The CRA Compliance Wizard is an automated tool that helps SMEs understand and meet the CRA’s requirements. It provides a step-by-step guide to cybersecurity compliance, offering features like automated assessments, documentation generation, and cybersecurity certification support.

2. Security-by-Design - CRACoWi helps SMEs integrate cybersecurity into every stage of the product lifecycle - from initial design to the end-of-life phase. This proactive approach helps reduce vulnerabilities before products even reach the market.

3. Capacity Building and Education - CRACoWi also aims to educate SMEs on the importance of cybersecurity through training sessions, awareness campaigns, and webinars. This capacity-building ensures that SMEs are not only compliant but also resilient, and capable of navigating future cybersecurity challenges independently.

💡TikoBits: Digital Europe Programme The Digital Europe Programme (DEP) is an EU initiative that aims to strengthen Europe’s digital capacity by funding key projects that build infrastructure, drive digital skills, and support innovative technology adoption. The DEP is funding initiatives like CRACoWi to boost Europe’s digital resilience and competitiveness. We at Tiko Pro are helping companies get the necessary funding by consulting, preparing project documentation, or supporting communication and dissemination efforts of the project. If you have an idea, or a project ready for funding but not sure where and how to apply, contact us.

By using CRACoWi’s tools and taking a proactive approach to cybersecurity, SMEs can transform what might initially seem like a burden into a business advantage. Its goal is to demystify the complexities of the CRA and empower businesses to meet its requirements seamlessly. With the right tools and guidance, compliance becomes not just achievable but also a pathway to greater market success.

And to add, CRACoWi makes compliance achievable for SMEs without requiring extensive technical expertise or resources. For many small businesses, this is a game-changer, as it reduces the cost and complexity of meeting cybersecurity standards while enabling them to focus on growth and innovation.

Don’t Wait - Take Action Now

The Cyber Resilience Act is reshaping the digital product market in the EU, and compliance is critical for any business aiming to succeed. For SMEs, the CRA is a chance to enhance product security, build trust with customers, and stand out in a crowded marketplace. But with new regulations come challenges, and that’s where CRACoWi comes in - to make the journey to compliance smoother and more efficient.

If you’re an SME, manufacturer, or distributor navigating the complexities of the CRA, now is the time to explore the tools and resources available to you. Make CRACoWi your first step toward easier compliance.

For more information on how CRACoWi can help your company comply with the CRA and build a safer digital future, sign in to the project list at www.cracowi.eu and follow the project on LinkedIn for updates, insights, and opportunities to participate in shaping Europe’s cybersecurity future.

Don’t risk non-compliance - start your journey to resilience today.

👉 Follow CRACoWi on LinkedIn