The Cyber Resilience Act (CRA)

The Cyber Resilience Act addresses the Union’s urgent need to strengthen cybersecurity as connected devices proliferate and cyberattacks increasingly affect the economy, democracy, consumer safety, and health. Russia’s increased hybrid warfare underpins the situation.

The Regulation identifies two core problems: the low cybersecurity level of products with digital elements (PwDE)—evidenced by widespread vulnerabilities and inconsistent security updates—and the lack of user understanding of and access to security information, which prevents secure product selection and use.

To remedy these issues and reduce fragmentation across Member States, the CRA establishes a uniform EU‑wide framework of essential cybersecurity requirements to improve cyber resilience and support the functioning of the internal market.