By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

Adoption of the EU Cyber Resilience Act is coming in 2024. This means that if you make software or hardware that’s sold in the EU and don’t fall within one of Act’s four product exemption categories, you’ll soon be legally required to comply with the Act’s requirements or risk penalties.

If you’re not using a modern package management system as part of your CI/CD process, you may find it harder and more time-consuming than others to meet the compliance requirements—particularly the requirements to minimize vulnerabilities and be transparent with consumers about the cybersecurity aspects of your products. (Read our post 

How To Comply With the EU Cyber Resilience Act

 for full details on compliance requirements.)

For instance, dated, legacy systems often:

offer limited visibility, which could make it challenging to identify and address vulnerabilities in the timeframes required by the CRA;

may not include automatic scanning tools for identifying vulnerabilities in dependencies, leaving teams to handle this manually—which is a time drain and introduces human error;

can struggle to manage track, and analyze the complex dependencies that are characteristic of modern software development; and

lack robust logging, audits, and reporting, making it harder and more time-consuming to assess, prioritize, and respond to software security issues.

In contrast, modern cloud-native artifact management systems, like 

, are built by design to secure software development across the entire software lifecycle—from pull-down to distribution—streamlining your team’s CRA compliance efforts through the benefit of:

Specifically, we can help you achieve the standards set out by the new CRA with our 

We’ll continue to create features in Cloudsmith that support our customers as the Regulation’s requirements evolve.

Want to know more about how Cloudsmith can support your CRA compliance efforts? Start your free trial now or talk to sales today.

Ciara Carey

Solutions Engineer

Simplify CRA Compliance With Modern Tooling

Update: You can find the most recent article on how Cloudsmith helps create the foundation for CRA compliance 

This week, the European Union (EU) reached an agreement on the 

Set for adoption in 2024, the CRA aims to protect consumers from insecure digital products, introducing mandatory cybersecurity measures such as vulnerability disclosure, Software Bill of Materials (SBOMs), and security updates throughout the product life cycle.

The CRA covers a wide range of digital products, from operating systems to baby monitors. Companies affected by this Act have 36 months to comply, facing penalties of up to €15 million or 2.5% of global turnover for non-compliance.

While most digital products may self-regulate, some, like Firewalls, Operating Systems, or Smart Meters, face more stringent cybersecurity requirements.

Despite the welcome, the CRA sparked concerns, especially in the Open Source Software (OSS) community, fearing inadequate exemptions and burdensome vulnerability reporting. The final version addressed some worries by extending exemptions to non-profit OSS organizations. Additional criticisms focus on potential disadvantages for EU businesses and uncertainties regarding auditing and funding.

The CRA introduces the following requirements for digital products sold in the EU:

Manufacturers must provide consumers with timely security updates for several years after purchase. The support period is designed to align with the expected lifespan of the products.

Manufacturers must disclose and patch vulnerabilities promptly and without charge. Manufacturers that discover a vulnerability in an OSS dependency will be required to notify the maintainer.

Manufacturers must report actively exploited vulnerabilities within 24 hours to both the competent Computer Security Incident Response Team (CSIRT) and The European Union Agency for Cybersecurity (ENISA) through a unified reporting platform. There are some narrow conditions where ENISA does not need to be informed, but they must receive adequate information to monitor systemic risks.

Manufacturers must include a SBOM in a common format, detailing at least top-level dependencies. Manufacturers must provide the SBOM to both ENISA and market surveillance authorities.

Member States will designate market surveillance authorities to enforce the EU Cyber Resilience Act. If a product is non-compliant, these authorities can:

Manufacturers can face fines of up to €15 million or 2.5% of their total worldwide annual turnover for non-compliance with essential cybersecurity requirements under the Cyber Resilience Act. For other obligations, fines can reach €10 million or 2% of the total annual turnover.

Products meeting the CRA’s essential requirements will receive the 

, signifying compliance with the Act's cybersecurity standards.

This marking is necessary to place your product on the market within the European Union.

The Regulation applies “all products with digital elements whose intended and reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.”
That’s a lot of products!

Most products are likely to self-regulate and apply the CE mark. However, the CRA specifies two categories of ‘critical products’ that are subject to more stringent requirements due to their higher perceived risk. These are divided into class I and class II, with class II products representing a greater risk. Manufacturers of class II products must involve a third party in their compliance assessment process.

These products are vital to the functioning of critical services and entities. Examples of Class I products include:

firewalls, intrusion detection/prevention systems;

industrial automation and control systems (IACS);

security information and event management (SIEM) systems; and

Class II are considered by the CRA to have a somewhat higher level of criticality compared to Class I. Examples of Class II products include:

operating systems for servers, desktops, and mobile devices;

hypervisors and container runtime systems;

public key infrastructure and digital certificate issuers;

secure elements, hardware security modules (HSMs);

smartcards, smartcard readers, and tokens;

robot sensing and actuator components; and

Not every digital product must comply with the new Regulation. Here are the exceptions.

The EU Cyber Resilience Act does not apply to Software-as-a-Service (SaaS) products.

Earlier drafts of the Act had an exemption for OSS individuals, but there was a gray area. It was unclear whether OSS organizations and contributions that could be deemed commercial would be exempt.

The final draft of the CRA now exempts free and open-source software developed or supplied without commercial intent. Notably, non-profit organizations selling OSS but reinvesting revenues in non-profit activities are also excluded. This exclusion protects the open-source community from unnecessary regulatory burdens.

The proposed Regulation won't cover products with digital elements already regulated by specific laws, such as:

medical devices (Regulation EU 2017/745 and EU 2017/746)

products certified under aviation safety (Regulation 2018/1139)

motor vehicle products (Regulation EU 2019/2144).

Products developed or modified exclusively for national security or defense purposes are excluded from the scope of the regulation.

The EU Cyber Resilience Act represents a significant stride in strengthening digital security across the EU.

By setting clear standards for cybersecurity, the EU aims to empower consumers, build trust in digital products, and establish itself as a global leader in cyber resilience.

Will the CRA get the balance right between security and innovation? Will it suppress the use of OSS? Will it be overly burdensome for businesses, especially SMEs? Only when the Act is being implemented will we see the true impact on cybersecurity, innovation, and the broader digital landscape.

Simplify CRA compliance with the help of modern tooling

How to comply with the EU Cyber Resilience Act

? The act is an EU regulation that aims to tackle low cyber security levels and make it easier for consumers to identify and choose secure digital products. First announced in the 2020 EU Cybersecurity Strategy, it’s the cyber security equivalent of GDPR and complements other cyber security legislation, like the NIS2 Directive.

The Act (also referred to as the CRA) applies to the vast majority of digital products sold in the EU—from operating systems to baby monitors—and when it comes into force in 2024, affected companies will have 36 months to adapt to the new requirements and become compliant.

At the minute, many digital products lack robust security measures and it’s often impossible for ordinary consumers to assess the security of those products. The CRA addresses this by introducing:

mandatory cyber security requirements for hardware and software products; and

 on products to signify they’re compliant.

Requirements include vulnerability handling, security updates, 

, and reporting actively exploited vulnerabilities within 24 hours of becoming aware of them. By mandating these measures throughout the product lifecycle, the Act aims to:

 Products entering the EU market must not have significant vulnerabilities that can be hacked.

 Manufacturers must provide clear and transparent information to consumers on the cyber security of their products. This includes secure default configurations, protection mechanisms against unauthorized access, and encryption of sensitive data.

 A key aspect of the CRA is the legal requirement for manufacturers to provide security updates for a defined period after purchase, reflecting the expected product lifespan.

The majority of digital products are likely to be self-regulated, but some products—like firewalls, SIEMs, operating systems, and smart meters—are held to more stringent cyber security requirements, including a third-party audit.

The open-source community has raised concerns about the Act, fearing its vulnerability reporting burdens. However, its final version does extend exemptions to non-profit OSS organizations. Other criticisms include potential disadvantages for EU businesses and uncertainties surrounding auditing and funding.

Will your product be affected by the CRA? If so, find out 

how to comply with the EU Cyber Resilience Act

Need to get a jump on CRA? Find out how to 

simplify CRA compliance with the help of modern tooling

Cloudsmith Blog

Simplify CRA Compliance With Modern Tooling

How to comply with the EU Cyber Resilience Act

What is the EU Cyber Resilience Act?