The Cyber Resilience Act (CRA) is a comprehensive European Union regulation designed to establish mandatory cybersecurity requirements for products with digital elements (hardware and software). Passed in 2024, it aims to improve the security of digital products throughout their entire lifecycle, from design to end-of-life.
The CRA addresses the growing cybersecurity threats by ensuring that manufacturers, importers, and distributors take responsibility for the security of their products before they enter the EU market. This landmark legislation will fundamentally change how digital products are developed, marketed, and maintained across Europe.
Key obligations include:
- Vulnerability disclosure
- Mandatory security updates for the product's supported lifetime
- Conformity assessment process
CRACI automatically helps you meet these obligations — continuously scanning your CI/CD pipeline for vulnerabilities, automatically sending vulnerability disclosures to the relevant authorities, generating audit-ready compliance reports, and keeping your security documentation up to date throughout your product's lifecycle.