Cyber Resilience Act: the EU regulation enters into force

2024-12-10 · Publisher : Union européenne · Domain : Cloud & DevOps

On 10 December 2024, the Cyber Resilience Act (CRA) enters into force in the European Union. It requires manufacturers of digital products to ensure security by design and vulnerability handling throughout the lifecycle.

### Background On 10 December 2024, the European Cyber Resilience Act (CRA) enters into force. It sets cybersecurity requirements for products with digital elements placed on the Union market, software included. Its obligations apply in stages, with two main milestones given by the Commission. ### Key facts - Entry into force: 10 December 2024. - Reporting obligations for actively exploited vulnerabilities and incidents: from 11 September 2026. - Application of the main obligations: 11 December 2027. - Requirements: security by design, updates and maintenance, vulnerability management throughout the product lifecycle, CE marking. - Third-party assessment (notified body) for certain high-risk products, and specific provisions for open source software contributors. ### Why it matters The CRA turns software supply chain security into a regulatory obligation for vendors and integrators delivering products to the European market. For a consulting firm, this means requirements on component traceability, vulnerability handling and the ability to notify: CI/CD pipeline topics as much as compliance ones. The 2026 and 2027 milestones leave limited time to get organized. Consulting firms that deliver products with digital elements may be concerned depending on whether they act as manufacturer or integrator: qualification is done contract by contract. The regulation applies to products placed on the Union market, wherever they are made. ### Takeaway The text turns software security good practice into obligations, with a first reporting deadline in September 2026.

Tags : Réglementation, Europe, Sécurité, CI/CD