As digitalisation accelerates worldwide, more and more products offer connectivity, remote control, software update and data exchange capabilities. At the same time, cyber attacks, data breaches, ransomware and supply chain vulnerabilities continue to increase, and traditional product safety requirements no longer meet the regulatory needs of the digital age.

Background

Against this backdrop the EU has introduced the Cyber Resilience Act (CRA), establishing a unified cybersecurity regulatory system for digital products. The regulation is regarded as one of the most important cybersecurity thresholds for the European market in the years ahead, and will profoundly affect manufacturing, the software industry and the smart hardware supply chain worldwide.

For Chinese companies, whether manufacturer, brand owner, importer, OEM or ODM, or software developer, any product entering the EU market requires CRA compliance preparation as soon as possible.

What is the CRA?

The CRA is the EU Cyber Resilience Act, a mandatory cybersecurity regulation for products with digital elements.

Its core objectives are:

1. Raise default product security

Products must have reasonable cybersecurity design before they are placed on the market, rather than being patched after vulnerabilities appear.

2. Strengthen manufacturer responsibility

Manufacturers are responsible for cybersecurity throughout the product lifecycle, including design, delivery, maintenance and vulnerability remediation.

3. Harmonise EU market rules

The regulation resolves the previous inconsistency between Member State requirements and creates a unified access system.

4. Protect consumers and business users

It reduces the risks arising from weak passwords, default credentials, missing update mechanisms and unpatched vulnerabilities.

What does the CRA mean for companies?

In the past, companies exporting to Europe focused on:

· CE;

· EMC;

· LVD;

· RED;

· RoHS;

· REACH.

In future, meeting the traditional CE directives alone will not be enough.

If a product has digital functions, the CRA becomes a new mandatory requirement.

In other words: a product must not only be safe to use, it must be safe to connect. It must not only be sellable, it must withstand cyber attack.

Which products are affected?

The scope of the CRA is very wide, covering almost every product with digital elements.

1. Consumer electronics

· Smart cameras;

· Smart door locks;

· Smart speakers;

· Routers;

· NAS storage devices;

· Smart TV boxes;

· Wearable devices;

· Smart home appliances;

· Smart toys for children.

2. Commercial equipment

· POS terminals;

· Vending machines;

· Printers and copiers;

· Access control systems;

· Security equipment.

3. Industrial equipment

· PLCs;

· HMIs;

· Industrial gateways;

· Smart meters;

· Industrial robots;

· SCADA edge devices.

4. Software products

· Management software;

· Cloud platform clients;

· Mobile apps;

· Firmware systems;

· Network management tools;

· IoT platform software.

Which products carry the highest risk?

The EU classifies some products as important or critical categories, which are subject to stricter supervision, for example:

· Firewalls;

· Identity authentication systems;

· Password management systems;

· Network management equipment;

· Critical industrial control equipment;

· Security software;

· Operating system products.

Such products may require the involvement of a notified body in the assessment rather than a manufacturer's self-declaration.

What are the core technical requirements?

In essence, the CRA requires companies to build systematic product security capability.

1. Security by design

The development stage must take account of:

· Secure default configuration;

· No weak passwords;

· Least privilege;

· Secure boot mechanisms;

· Authentication design.

2. Data protection

· Encrypted storage of sensitive information;

· Encryption of communication channels;

· Protection of user privacy;

· Protection of credentials.

3. Vulnerability management mechanism

Companies must establish:

· A vulnerability intake channel;

· A security response process;

· A fix release mechanism;

· CVE tracking.

4. Software update mechanism

Products must support:

· Secure upgrade capability;

· Update integrity verification;

· Signature verification;

· Protection against downgrade attacks.

5. Documentation and traceability

Companies must retain:

· Technical documentation;

· Risk analysis;

· Test records;

· Declarations of conformity;

· Lifecycle maintenance policy.

What are the most common pitfalls?

1. Default passwords

For example admin/admin, 123456 or a fixed password.

2. Unsigned firmware

Attackers can flash malicious firmware.

3. Exposed app interfaces

Unauthorised API access, weak authentication and similar issues.

4. Excessive cloud platform privileges

Users can access data beyond their authorisation.

5. No security update mechanism

Vulnerabilities cannot be fixed after the product is on the market.

6. Missing documentation

Security features exist but there is no evidence chain to demonstrate them.

The CRA matters especially for Chinese manufacturers

China is a major source of smart hardware for the EU, and many companies operate through:

· ODM or OEM models;

· White-label shipments;

· Rapid iterative development.

These models have historically prioritised delivery over security. Once the CRA applies, however, customers will require:

· CRA declarations of conformity;

· Cybersecurity test reports;

· Evidence of vulnerability management mechanisms;

· Software update commitments;

· Technical documentation support.

Companies that are unprepared are highly likely to be replaced.

What professional services can an information security laboratory provide?

As a specialist information security laboratory, we help companies move from uncertainty to an actionable plan.

1. CRA applicability determination

Helping determine:

· Whether the product is in scope;

· Whether it is a default or an important product;

· Whether a notified body must be involved.

2. CRA gap assessment

Based on the existing product design, identifying:

· Missing functions;

· High-risk items;

· Compliance weaknesses;

· Remediation priorities.

3. Cybersecurity testing

Including:

· Vulnerability scanning;

· Penetration testing;

· Firmware analysis;

· OTA update verification;

· Default password checks;

· Bluetooth and Wi-Fi security testing;

· Cloud interface security testing;

· App security testing.

4. Technical documentation support

Helping produce:

· Risk assessment reports;

· Security architecture descriptions;

· Vulnerability management procedures;

· Update strategy;

· Declarations of conformity (DoC).

5. EU market certification route planning

Helping companies reduce trial and error and enter the market quickly.

Why prepare now?

Although the CRA has a transition period, companies cannot wait until the last day. In practice:

· Product remediation cycles are long;

· Software development schedules are long;

· Customer audits start early;

· Technical documentation takes time to prepare;

· Third-party body capacity is limited.

Preparing a year ahead costs far less than remedial work close to shipment.

Who should act first?

The following companies should start immediately:

· Exporters to the EU;

· Sellers on Amazon Europe;

· Smart home brands;

· Camera and lock manufacturers;

· POS and payment terminal makers;

· IoT platform companies;

· Industrial equipment manufacturers;

· Software system developers.

The future is not only about price

In the past customers asked: how much, and when can you deliver?

In future they will ask:

Do you comply with the CRA? Do you have a vulnerability response mechanism? Can you keep updating? Can you provide test reports?

That is the market trend.

Act early: compliance is competitiveness

The arrival of the EU CRA will redefine the rules for exporting smart products worldwide. Those who build cybersecurity capability first will obtain the European market pass first. Those who remain in a traditional manufacturing mindset will be left behind by the new rules.

NTEK Information Security Laboratory

Focused on global cybersecurity regulation and certification services

Service scope:

· EU CRA;

· RED EN 18031;

· UK PSTI;

· IEC 62443;

· ISO 21434;

· Data Act;

· Penetration testing;

· Security assessment;

· Compliance consulting.

If your products are intended for the European market, contact NTEK Information Security Laboratory for a CRA product pre-assessment, remediation roadmap and testing and certification plan.