Strengthening Your Product’s Cybersecurity for the European Market
Companies who chose us
Why the CRA Matters
In an increasingly interconnected world, digital products serve as critical entry points into networks and infrastructures. The CRA responds to growing cybersecurity concerns by transforming security-by-design from a recommendation into a legal obligation.
Manufacturers must now demonstrate that their products meet essential cybersecurity requirements from design and development to deployment, maintenance, and end-of-life.
The CRA ensures:
Security throughout the entire product lifecycle
Consistent requirements across the EU’s internal market
Greater consumer and business confidence
Clear, transparent accountability for manufacturers, importers, and distributors
.png)
MDR and IVDR regulations
for Medical Devices
It is a challenging task to secure devices against cyber threats while clients expect to preserve functionality without overcomplicated security measures.
The software usually connects to the internet or hospital networks, therefore data might be available through mobile phones or other connected devices.
We provide conformity assessments for numerous standards related to medical devices’ cybersecurity resilience.
Among many novelties linked to cybersecurity risks, two new regulations on medical devices have been adopted and entered into force on 25 May 2017.
These regulations introduce new essential cybersecurity requirements for all medical devices that incorporate electronic programmable systems and software that are medical devices in themselves within the EU.
This means that manufacturers have to develop and manufacture their products in accordance with the state of the art technologies and taking into account the principles of risk management.
The above affects information security, as well as requires to set out minimum requirements concerning IT security measures, including protection against unauthorized access to vulnerable personal data.
FAQ
What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act (CRA) is a European Union regulation that sets horizontal cybersecurity requirements for all products with digital elements — including connected hardware and software, from IoT devices to standalone software applications. Unlike sector-specific laws, the CRA ensures a unified minimum level of cybersecurity across the entire EU market.
It requires manufacturers to consider cybersecurity throughout the entire product lifecycle — from design and development to maintenance and vulnerability handling. This means security can no longer be treated as an afterthought but must be built into products by design (“security by design” and “security by default”).
When will the CRA become applicable?
Although the CRA formally entered into force on 10 December 2024, it will only become fully applicable on 11 December 2027. This three-year transition period allows manufacturers and other stakeholders to adjust their development, compliance, and support processes in line with the new requirements.
After this date, any product with digital elements that is not compliant with CRA requirements cannot be legally placed on the EU market. Companies should therefore already start preparing by identifying affected products and aligning existing standards and risk management processes with the CRA.
What happens to the Radio Equipment Directive Delegated Act (RED-DA)?
The RED Delegated Act (EU) 2022/30 — which currently defines cybersecurity requirements for certain radio-connected products — will be repealed on 11 December 2027, the same day the CRA becomes fully applicable.
From that point onward, the CRA will serve as the overarching legal framework for product cybersecurity, avoiding duplication of obligations. Until then, manufacturers must still comply with the RED-DA, and existing RED-DA compliance work will still support future CRA compliance.
How are RED-DA and CRA related?
Both the RED-DA and the CRA impose mandatory cybersecurity requirements enforceable via CE marking.
- RED-DA applies to internet-connected radio equipment.
- CRA applies to all digital products, including software-only products.
Many devices fall under both frameworks (e.g., smart home devices, routers, industrial gateways). Once the CRA applies, it will take precedence, creating a single streamlined cybersecurity framework.
What is “Module A” and how does it relate to the CRA?
“Module A” refers to the Internal Production Control conformity assessment procedure. Under the CRA, it allows manufacturers to self-declare conformity if they fully implement relevant harmonised standards.
Manufacturers using Module A must implement internal processes ensuring their product meets all essential cybersecurity requirements, then issue an EU Declaration of Conformity, taking full legal responsibility.
However, Module A can only be used if harmonised standards (hENs) fully apply. If no standards exist or only partially apply, additional justification or third-party involvement may be required.
What is “Presumption of Conformity” (PoC)?
Presumption of Conformity means that a product is presumed to meet CRA requirements if it complies with harmonised standards (hENs) published in the Official Journal of the European Union.
By following these standards, manufacturers can demonstrate compliance in a straightforward and recognised way. However, PoC only applies to the aspects covered by the standards; any uncovered risks must be handled separately.
Important: No harmonised standards have yet been published under the CRA. Therefore, full Presumption of Conformity is currently impossible, and manufacturers must rely on alternative assessment methods until standards are finalised.
Can all products achieve full PoC under Module A?
No. Under the CRA, only Class I products listed in Annex III (“important products with digital elements”) can achieve full PoC by applying harmonised standards.
For other product classes, only partial PoC will be possible — especially because the complete set of CRA-related harmonised standards is still under development.
Currently, no harmonised standards exist, meaning even Class I products cannot yet claim full Presumption of Conformity.
How do harmonised standards (hEN) support CRA compliance?
Harmonised standards form the technical backbone for demonstrating CRA compliance. The EN 18031 series — originally used for RED-DA — is expected to form the basis for future CRA harmonised standards.
This continuity means current RED-DA alignment efforts will continue to be useful and will ease the transition to CRA compliance.
Once harmonised standards are published, they will provide manufacturers with clear, recognised methods to meet cybersecurity and vulnerability management requirements.
Important: Candidate standards (such as EN 18031-1/-2/-3) are in development, but none have yet been harmonised. Until published in the Official Journal, compliance must rely on custom technical documentation and risk assessments.
Our complex Medical Device Security solution includes the following services
Gap analysis
Risk assessment
Preparation for certification
