EU Manufacturers' liabilities grow under the Cyber Resilience Act

With the EU’s Cyber Resilience Act (CRA), the industry is dealing with one of the strictest regulatory requirements. Manufacturers, importers and even distributors of products with digital elements – in other words, anything with a microchip – will be required to take a number of stringent measures.

It follows warnings that the adoption of connected devices during the pandemic has led to a dramatic increase in cyberattacks. If left unchecked, the cost of cyberattacks will continue to rise, according to the World Economic Forum and the Council on the Connected World.

“Among other things, the Cyber Resilience Act will require a cyber risk assessment before a product is put on the market,” says Jan Wendenburg, CEO of ONEKEY.

”All manufacturers must start now to integrate the upcoming requirements into their product development, as the development of new products and variants often takes many months and years.

Patching vulnerabilities

In addition to security measures against unauthorised access, companies will also be required to manage software vulnerabilities and patches in the future – before damage is caused by exploitable vulnerabilities.

“Throughout the entire product lifecycle, manufacturers must effectively manage the vulnerabilities of their products, conduct regular testing and demonstrate comprehensive patch management. There is also an obligation to maintain clear documentation.” Wendenburg continues.

This includes maintaing a Software Bill Of Materials (SBOM), that details all software products  – including hidden ones –in a device or system. Depending on the product and the components installed, there can be hundreds of different assemblies, each with its own “brains” and hidden risks.

Staff structures  also need to be put in place: Certain tasks and duties of the CRA need to be performed by an officer on behalf of the organisation. This includes, for example, the role of contact person for the market surveillance authorities.

Redesigning established processes

Companies will also need to regularly update the data inventory on the products and keep the data for up to ten years after the product has been placed on the market.

“It is becoming clear that the pressure – even if the EU Commission postpones the law somewhat – is high,” continues Wendenburg. ”Products and components, including those from third-parties, have to be tested for vulnerabilities, manufacturers and importers must document this and provide the necessary capacity to meet the information obligations.

”For industry, this means rethinking established development and production processes. Those who do not act in time here risk high penalties from the authorities,”