From September 2026, the Cyber Resilience Act (CRA) will come into force. It defines uniform security requirements for hardware and software products placed on the EU market. The aim is to increase the cyber resilience of products, minimize risks for end customers, and strengthen the protection of critical infrastructures. For companies that use or provide software or hardware, this means significant changes – both in terms of compliance and their own IT security strategy.
1. Who is affected by the CRA?
The CRA primarily targets:
- Hardware manufacturers: All providers of electronic devices that are software-controlled.
- Software developers and vendors: Providers of standard software, operating systems, middleware, and components integrated into third-party products.
Key requirements:
- Products must be designed to be "cyber resilient."
- Security vulnerabilities must be reported and fixed promptly.
- Manufacturers must provide verifiable Software Bills of Materials (SBOMs).
- Only authorized developers may access critical source code to protect the software supply chain.
Companies distributing or using products under EU law must therefore ensure that the software and hardware they use are CRA-compliant.
2. Core requirements of the Cyber Resilience Act
The CRA defines clear security requirements for products:
- Security by Design – Products must be secure from the outset.
- Patch Management – Manufacturers are required to provide security updates within defined timeframes.
- Transparency – Disclosure of components (SBOM) to assess security risks.
- Reporting obligations – Security incidents must be reported promptly.
Companies that secure their systems with solutions supporting access control, audit trails, and secure software delivery can already cover many CRA requirements today.
3. Securing the software supply chain
A central topic of the CRA is the security of the software supply chain. Many security incidents occur because third-party components are compromised. The new requirements include:
- Source code protection: Only authorized developers may modify critical modules.
- SBOM obligation: Software bills of materials must be available and verifiable.
- Continuous monitoring: Products must be monitored for vulnerabilities.
Companies that implement solutions ensuring SBOM integrity and strictly controlling access rights meet a core requirement of the CRA.
4. Supply chain security in practice
The CRA requires companies to systematically manage supply chain risks, including:
- Reviewing all software and hardware suppliers.
- Ensuring traceable security updates.
- Documenting all critical components in an SBOM.
Companies using platforms that monitor and document the entire supply chain can quickly demonstrate CRA compliance.
5. Reporting security incidents
Under the CRA, there is a mandatory reporting deadline for security incidents for manufacturers. The goal is to detect and address vulnerabilities early, before end customers are affected.
Companies benefit from tools that enable automated detection and reporting of incidents, helping them meet legal deadlines.
6. Benefits for companies
Companies using CRA-compliant products gain several advantages:
- Reduced risk of cyberattacks.
- Compliance with legal requirements and avoidance of penalties.
- Customer trust through demonstrably secure products.
- Simplified supply chain audits thanks to SBOM transparency.
7. Recommendations for 2026
- Implement SBOMs: Document all software components in use.
- Secure access rights: Only authorized developers may access critical modules.
- Establish monitoring & reporting: Detect security incidents automatically and report them on time.
- Review supply chains: Regularly audit subcontractors and third-party providers.
- Manage updates & patches: Perform regular maintenance and promptly fix vulnerabilities.
By using solutions that cover these points, companies are well prepared for the CRA.
8. How KOBIL solutions support companies with the CRA
Companies face the challenge of providing software and hardware products transparently, securely, and CRA-compliant. KOBIL solutions help organizations by ensuring the integrity of Software Bills of Materials (SBOMs), controlling access rights to critical source code, and documenting changes traceably. They enable centralized monitoring of security incidents and simplify timely reporting to authorities. Through these measures, companies can protect their software supply chains, meet compliance requirements, and significantly reduce the risk of cyberattacks without adding operational complexity.
Conclusion
The Cyber Resilience Act significantly tightens requirements for software and hardware providers. For companies, this means greater transparency, more responsibility, and the need to continuously monitor supply chains and software. In practice, organizations that already implement systems securing SBOMs, controlling access rights, and centrally reporting security incidents are well positioned to meet the CRA’s demands.