EU Draft Guidance on Cyber Resilience Act Sets New Compliance Obligations for IoT Manufacturers
What Happened — The European Commission released draft guidance for the Cyber Resilience Act (CRA), a 2024 law that imposes security‑by‑design and post‑market update requirements on all “digital products” sold in the EU, including IoT devices, software, and certain cloud services. The guidance, open for comment until April 13, clarifies reporting deadlines, vulnerability‑disclosure timelines, and supply‑chain risk‑assessment expectations that manufacturers must meet to obtain the CE mark.
Why It Matters for TPRM —
- Non‑compliance will block market access to the EU’s single market, exposing third‑party risk to revenue loss and legal penalties.
- Mandatory five‑year security‑update windows and 24‑hour breach reporting raise the bar for vendor security governance and continuous monitoring.
- Supply‑chain risk assessments become a contractual prerequisite for many downstream contracts, affecting procurement and vendor‑risk programs.
Who Is Affected — IoT device manufacturers, software vendors, cloud‑service providers, and any third‑party suppliers that deliver “digital products” to EU customers (e.g., smart‑home appliances, industrial control systems, medical IoT, SaaS platforms).
Recommended Actions —
- Review all current and prospective EU‑bound vendors for CRA readiness; request evidence of security‑by‑design processes and update‑policy roadmaps.
- Update contractual clauses to require CRA‑aligned vulnerability‑disclosure (≤24 h) and five‑year support commitments.
- Incorporate CRA compliance checks into your continuous vendor‑monitoring platform; flag any gaps before the December 2027 enforcement date.
Technical Notes — The CRA treats “digital products” broadly, covering firmware, operating systems, and even certain cloud services. Key technical obligations include: mandatory security‑by‑design, documented supply‑chain risk assessments, a minimum five‑year security‑update lifecycle, and mandatory reporting of actively exploited vulnerabilities to ENISA. Source: DataBreachToday