CONSUMER IOT
November 12, 2026 | 10:00 AM ET Understand key CRA requirements for consumer IoT devices and the practical steps needed to support compliance readiness.
Register Now
Cyber Resilience Act (CRA): What North American Manufacturers Need to Know
The European Union’s Cyber Resilience Act (CRA) is reshaping cybersecurity expectations for products with digital elements. Although the regulation originates in Europe, its impact extends globally. Organizations that place connected products on the EU market need to understand how CRA requirements may affect market access, product development, vulnerability management, and ongoing cybersecurity responsibilities.
For many North American manufacturers, the CRA represents more than a future compliance milestone. Reporting obligations began applying on September 11, 2026, while the regulation’s main obligations apply from December 11, 2027. Preparing early gives organizations time to assess product scope, review cybersecurity processes, and strengthen the evidence needed to support conformity activities.
The CRA also creates an opportunity to build greater confidence in product security. Organizations that integrate cybersecurity into product planning, development, testing, and post-market support can be better positioned to respond to regulatory requirements and evolving customer expectations.
Why North American Manufacturers Should Care
The CRA establishes mandatory cybersecurity requirements for products with digital elements and places responsibilities on manufacturers across the product lifecycle. Key considerations include:
- Products placed on the EU market may need to meet applicable CRA requirements.
- Cybersecurity is becoming a product-level regulatory requirement rather than a voluntary best practice.
- Manufacturers need processes that address cybersecurity during design, development, production, and post-market support.
- Vulnerability handling, security updates, documentation, and conformity assessment may become important parts of market-readiness planning.
- Many CRA expectations align with established secure-development and product-cybersecurity practices.
Common CRA Themes Across Industries
Specific obligations depend on the product, its classification, and how it is placed on the EU market. Across industries, several themes consistently shape CRA preparation.
Security by Design
Cybersecurity needs to be considered from the beginning of product development, not added only after a product is complete.
- Integrate cybersecurity into product requirements and design decisions.
- Establish secure development lifecycle processes.
- Conduct cybersecurity risk assessments and threat modeling.
- Document security-related design decisions and controls.
Vulnerability Management
Manufacturers need a structured approach for identifying, evaluating, and addressing product vulnerabilities.
- Identify, track, prioritize, and remediate vulnerabilities.
- Establish coordinated vulnerability disclosure processes.
- Monitor cybersecurity issues after product release.
- Maintain clear ownership for vulnerability and incident response.
Product Security Testing
Testing can provide evidence that cybersecurity controls have been evaluated before products reach the market.
- Validate cybersecurity controls before market release.
- Perform vulnerability assessments and penetration testing where appropriate.
- Document testing activities, results, and remediation decisions.
- Use testing outputs to support readiness and conformity activities.
Lifecycle Security
Cybersecurity responsibilities continue after products are released.
- Provide security updates and patches during the applicable support period.
- Monitor emerging vulnerabilities and product-security issues.
- Maintain cybersecurity documentation throughout the product lifecycle.
- Prepare processes for applicable vulnerability and incident reporting obligations.
Learn How the CRA Applies to Your Industry
DEKRA’s three-part Cyber Resilience Act Webinar Series provides practical, industry-specific guidance for organizations evaluating CRA applicability and readiness. Choose the session that best aligns with your products or attend more than one session to build a broader understanding across markets.
AUTOMOTIVE
November 19, 2026 | 10:00 AM ET | Learn how the CRA aligns with UNECE R155/R156 and discover practical next steps for OEMs and suppliers.
Register Now
INDUSTRIAL PRODUCTS
December 9, 2026 | 10:00 AM ET Learn how the CRA applies to connected industrial products sold in Europe and key considerations for compliance readiness.
Register Now
What You’ll Learn Across the Series
- The scope and applicability of the Cyber Resilience Act
- Key security and compliance requirements for manufacturers
- Manufacturer responsibilities throughout the product lifecycle
- Practical steps to prepare for CRA requirements
- Conformity assessment considerations
- Answers to participant questions during live Q&A sessions
Prepare for the Next Phase of CRA Requirements
The CRA is changing how connected products are designed, developed, maintained, and supported. Manufacturers that begin evaluating applicability, documentation, vulnerability handling, and product-security practices now will have more time to identify gaps and prepare for upcoming obligations.
Explore the DEKRA webinar series for practical guidance on the considerations most relevant to your industry and products.