In recent years the EU has steadily tightened cybersecurity supervision of digital products.

After the GDPR and NIS2, the Cyber Resilience Act (CRA) has become one of the regulations that manufacturing, consumer electronics, industrial control and software companies follow most closely.

Questions from industry and the regulatory background

Companies approaching the CRA tend to ask the same questions:

· Is my product within the scope of the CRA?

· Does the CRA apply to products that are not connected to the internet?

· Are chips CRA products?

· Is software a CRA product?

· Is industrial equipment a CRA product?

· What is the difference between the default, important and critical classes in the CRA?

In practice, the scope of the CRA is far broader than many companies imagine.

This article examines the scope of the CRA from four angles: the product definition, the scope of application, the exemptions and the product classification.

What does the CRA actually regulate?

The CRA is a cybersecurity regulation for products with digital elements.

Its core objective is to establish uniform cybersecurity requirements across the whole product lifecycle, ensuring that manufacturers take responsibility for cybersecurity throughout design, development, delivery and vulnerability management.

Unlike traditional product safety regulations, the CRA focuses on:

Whether a product has digital functions, and the cybersecurity risks that follow from them.

What is a product with digital elements?

The CRA defines products very broadly.

The regulation states that a product with digital elements means any software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.

Three keywords matter when reading this definition.

Digital elements

These include:

· Software;

· Firmware;

· Operating systems;

· Programs on a chip;

· Embedded code;

· Cloud processing functions.

Any product with digital processing capability may be subject to the CRA.

Data connection

The product does not have to be connected to the internet.

The regulation refers to:

A direct or indirect data connection to a device or network.

Accordingly, all of the following are possible connection types:

· Wi-Fi;

· Bluetooth;

· Zigbee;

· Thread;

· NFC;

· USB;

· RS232;

· RS485;

· CAN;

· Ethernet.

Even a product that never connects to the internet, and only exchanges data with another device, may fall within the scope of the CRA.

Reasonably foreseeable use

The CRA does not only consider the use declared by the manufacturer.

It also considers:

The ways in which users may reasonably use the product.

Manufacturers therefore cannot avoid the CRA simply by limiting what the manual describes.

Which products may fall within scope?

In practice the scope is very wide.

Consumer electronics

For example:

· Smart door locks;

· Smart cameras;

· Smart doorbells;

· Smart plugs;

· Smart switches;

· Smart lighting;

· Smart home appliances;

· Smart speakers;

· Smart televisions;

· Smart watches;

· Smart wristbands.

These products generally have software, firmware and data communication capability, and most of them fall within the scope of the CRA.

Software products

The CRA is not limited to hardware.

Software can also be a CRA product in its own right, for example:

· Operating systems;

· Browsers;

· VPN software;

· Network management platforms;

· Mobile applications;

· Cloud management software;

· Device configuration software;

· Remote control software.

Wherever software is placed on the market separately, it may constitute a product within the meaning of the CRA.

Industrial control products

The industrial sector is a key focus of CRA supervision, for example:

· PLCs;

· DCS;

· SCADA;

· CNC;

· Industrial gateways;

· Industrial switches;

· Industrial routers;

· Edge computing devices.

Because these products often affect the continuity of industrial production, they receive particular attention.

Industrial IoT products

For example:

· Industrial sensors;

· Industrial data acquisition terminals;

· Smart meters;

· Industrial wireless terminals;

· Industrial monitoring equipment.

Wherever a product has digital functions and communication capability, it generally falls within the scope of the CRA.

Chips and electronic components

This is the part that many companies overlook.

The CRA regulates not only end products but potentially also core electronic components, for example:

· MCUs;

· MPUs;

· FPGAs;

· ASICs;

· Secure elements;

· Security processors.

Semiconductor companies therefore also need to follow CRA requirements.

Which products are generally outside the CRA?

The CRA is not the only regulation covering digital products.

The EU has established dedicated regulatory systems for some heavily regulated sectors.

To avoid duplicate regulation, the CRA exempts certain products, typically including:

Medical devices

These are covered by the MDR and IVDR.

Vehicles and automotive electronics

These are covered by UNECE Regulations R155 and R156 and related rules.

Aircraft equipment

This is covered by the EASA aviation cybersecurity regulatory framework.

Certain marine and aerospace products

These are covered by sector-specific regulations.

In principle, the CRA therefore does not apply again to these sectors.

Why does the CRA classify products at all?

All CRA products must meet baseline cybersecurity requirements.

But different products have very different cybersecurity consequences.

If a smart plug is attacked, one household may be affected. If an industrial firewall is attacked, an entire factory may be affected. If a digital certificate system is attacked, an entire national digital trust system could be affected.

The CRA therefore adopts a risk-based approach, classifying products according to their importance and potential impact into:

· Default category;

· Important products, Class I;

· Important products, Class II;

· Critical products.

The default category: the largest group of products under the CRA

Many companies mistakenly believe that:

"Only important products need to comply with the CRA."

That is not correct.

The default category is also regulated by the CRA; its conformity assessment route is simply simpler.

What is the default category?

The CRA does not list a separate catalogue for the default category.

The default category is in effect defined by exclusion:

Products that are within the scope of the CRA but are not listed in the important or critical product catalogues.

In principle, all of these belong to the default category.

What kinds of product fall into the default category?

For example, consumer electronics:

· Smart door locks;

· Smart doorbells;

· Smart plugs;

· Smart lamps;

· Smart cameras;

· Smart home appliances.

Industrial products:

· Industrial sensors;

· Data acquisition terminals;

· Industrial communication modules;

· Industrial edge acquisition devices.

Software products:

· Companion apps;

· Data visualisation software;

· Local configuration software;

· User management tools.

Chip products:

· Wireless communication chips;

· Sensor chips;

· Audio chips;

· Display driver chips.

Although these products have digital functions, they do not perform critical network management or security functions, so they generally belong to the default category.

In terms of market volume, default category products account for the great majority of all products covered by the CRA.

Important and critical products

For products with greater cybersecurity impact, the CRA establishes dedicated catalogues.

Important products, Class I

These mainly include:

· Browsers;

· Password managers;

· VPN products;

· Network management systems;

· Firewalls;

· Routers;

· MCUs;

· PLCs;

· SCADA;

· Industrial IoT devices.

Important products, Class II

These mainly include:

· Operating systems;

· PKI systems;

· Industrial firewalls;

· General-purpose CPUs;

· HSMs;

· Secure elements;

· Smart cards;

· Smart electricity meters;

· Robot controllers.

Critical products

These mainly include:

· Tamper-resistant hardware security devices;

· Smart metering gateways;

· High-security encryption devices;

· Smart cards and similar security products.

These products perform critical security functions and are therefore subject to stricter conformity assessment requirements.

How should companies assess their own products?

We recommend working through the following steps in order:

Step 1: confirm whether the product is a product with digital elements.

Step 2: confirm whether it belongs to an exempt sector.

Step 3: confirm whether it is listed in the important products catalogue.

Step 4: confirm whether it is listed in the critical products catalogue.

Step 5: determine the applicable conformity assessment route.

The CRA is not a regulation aimed at "connected devices"; it is a cybersecurity regulation aimed at products with digital elements.

From consumer electronics and industrial control equipment to software platforms and chips, more and more products will be brought into a unified cybersecurity regulatory framework.

For companies, the first step in CRA compliance is not certification but accurately identifying whether a product falls within scope, and whether it is a default, important or critical product.

Only once the product classification is correct can the subsequent risk assessment, security by design, testing and verification, and conformity assessment proceed smoothly.