Is the EU Cyber Resilience Act a burden or an opportunity for manufacturers?

Question

Accepted Answer

The EU Cyber Resilience Act Represents a Significant Opportunity for Manufacturers

The EU Cyber Resilience Act (CRA) is presented not as a compliance burden, but as a "once-in-a-generation opportunity" for manufacturers. Those who proactively address its requirements stand to gain a structural competitive advantage, defining the market landscape for the next decade. The era of voluntary security measures is concluded, with the CRA mandating comprehensive security protocols for a vast array of connected devices.
Mandatory Security Updates and Incident Reporting

The CRA mandates that manufacturers provide security updates for their products throughout a five-year lifecycle. Furthermore, any confirmed security incidents must be reported within a 72-hour timeframe. These requirements are designed to ensure ongoing protection against emerging threats for connected devices, which encompass over 90% of IoT products with digital elements, including sensors, gateways, industrial equipment, and consumer devices.
Emphasis on "Security by Design" and Penalties for Non-Compliance

Manufacturers are now required to demonstrate security from the earliest stages of product development, adhering to a "security by design" principle. Documentation and vulnerability management obligations came into effect from September 2026. Non-compliance with the CRA can result in substantial penalties, reaching up to €15 million or 2.5% of a company's global annual turnover.
Strategic Market Access and First-Mover Advantage

Independent analyses suggest the average cost of CRA compliance is around €100,000 per product line. Considering the potential penalties, the financial rationale for compliance is clear. As the regulatory threshold for market entry increases, access to the EU market will become more selective, thereby creating a structural advantage for early adopters. Security is thus reframed from a cost to be minimised into an investment that enables market access, enhances competitive standing, and builds long-term resilience.
Kigen's Proactive Response as a Case Study

Kigen's experience with its eSIM technology serves as an example of acting ahead of regulatory demands. When significant vulnerabilities were identified in industry eSIM frameworks, Kigen rapidly developed and shared a patch within 72 hours, coordinating with the GSMA and adhering to ENISA disclosure guidelines. This swift action, taken before it was mandated by the CRA, demonstrates a commitment to industry security and provides a model for how manufacturers can build trust and mitigate risks effectively.

Reading history

Hide →

This history is cleared when the page is closed.

Is the EU Cyber Resilience Act a burden or an opportunity for manufacturers?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends