Regulation on Horizontal Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act)

The CRA introduces mandatory cybersecurity requirements for all products with digital elements sold in the EU. Products are classified into three categories: (1) Default — most products, self-assessment; (2) Important Class I — products listed in Annex III (e.g., identity management software, password managers, VPNs, network management tools) — self-assessment with harmonized standards or third-party assessment; (3) Important Class II — critical products listed in Annex III (e.g., OS, hypervisors, firewalls, industrial control systems) — mandatory third-party assessment. The regulation requires security throughout the product lifecycle, including a support period of at least 5 years (or expected product lifetime if shorter).