EU Cyber Resilience Act: Key Dates and Compliance Considerations for Product Developers

By Washington Laboratories | June 2026

As cybersecurity requirements continue evolving globally, manufacturers of connected products should begin preparing for new obligations under the European Union’s Cyber Resilience Act.

As connected products become increasingly integrated into consumer, commercial, industrial, and wireless environments, cybersecurity is becoming more than a product feature—it is becoming a regulatory requirement.

The European Union’s Cyber Resilience Act (CRA) establishes cybersecurity requirements for products with digital elements placed on the EU market. These requirements affect manufacturers, importers, and distributors and are intended to improve cybersecurity throughout a product’s lifecycle.

Manufacturers that sell connected products into the European market should begin assessing how these requirements may affect future product development, testing, documentation, and market access strategies.

Building upon previous Washington Laboratories coverage of cybersecurity developments in wireless communications, including Mike Violette’s article, Cybersecurity Developments in Wireless Communications, this update highlights key CRA dates and practical considerations for product developers preparing for future EU market access requirements.

What Is the EU Cyber Resilience Act?

The Cyber Resilience Act is a European Union regulation focused on cybersecurity for products with digital elements. It introduces requirements intended to ensure that connected products are designed, developed, maintained, and supported with cybersecurity in mind.

The CRA applies broadly to hardware and software products that connect directly or indirectly to another device or network. For manufacturers, this means cybersecurity considerations may need to be addressed earlier in the product development process and supported through technical documentation, vulnerability handling, software maintenance, and post-market monitoring.

What Products May Be Affected?

• Wireless devices
• Internet of Things (IoT) products
• Consumer electronics
• Network-connected equipment
• Industrial control systems
• Embedded systems and firmware-based products
• Software products placed on the EU market
• Products that include remote data processing solutions

For organizations developing products for the European market, the CRA may affect product design, software maintenance, vulnerability management, technical documentation, conformity assessment planning, and long-term product support.

Key CRA Dates for Manufacturers

While the full compliance deadline may appear distant, product development cycles can span multiple months or years. Manufacturers should begin evaluating the potential impact of the CRA now to avoid future compliance challenges, redesigns, or market access delays.

Key Compliance Considerations

The CRA introduces requirements that may involve multiple departments within an organization, including engineering, quality, regulatory affairs, cybersecurity, software development, product management, and supply chain teams.

Product developers and manufacturers should begin reviewing the following areas:

• Cybersecurity-by-design: Security should be considered during product architecture, design, and development rather than added late in the process.
• Cybersecurity risk assessment: Manufacturers should evaluate potential vulnerabilities, attack surfaces, misuse scenarios, and product security risks.
• Vulnerability management: Processes should be established for identifying, assessing, documenting, and addressing vulnerabilities.
• Incident reporting: Manufacturers should prepare procedures for reporting actively exploited vulnerabilities and severe cybersecurity incidents.
• Software updates: Products should include defined processes for secure updates, patches, and long-term maintenance.
• Technical documentation: Compliance planning should include documentation supporting cybersecurity design, risk assessment, testing, and conformity assessment activities.
• Supply chain coordination: Manufacturers should evaluate cybersecurity risks associated with components, software libraries, firmware, and third-party technologies.
• Post-market monitoring: Cybersecurity obligations continue after products enter the marketplace and require ongoing monitoring and support.

Why Early Planning Matters

The CRA represents a significant shift in how cybersecurity is addressed within product compliance programs. For many manufacturers, cybersecurity will need to be integrated into existing regulatory, quality, engineering, and product development workflows.

Waiting until the compliance deadline approaches may create challenges, particularly for products with long development cycles, complex software architectures, wireless functionality, or global market access requirements.

Early planning can help manufacturers:

• Identify potential cybersecurity gaps earlier in development
• Improve documentation readiness
• Coordinate engineering and regulatory activities
• Prepare vulnerability handling and incident response procedures
• Reduce the risk of redesigns or delayed EU market access
• Align cybersecurity planning with EMC, wireless, safety, and product compliance strategies

Cybersecurity and Wireless Product Compliance

Cybersecurity requirements are becoming increasingly connected to product compliance, particularly for wireless and network-connected devices. Products that once focused primarily on EMC, radio, safety, or telecommunications requirements may now need to address cybersecurity expectations as part of a broader compliance strategy.

This is especially important for manufacturers of wireless devices, IoT products, industrial systems, smart equipment, connected consumer products, and technologies that rely on software, firmware, cloud connectivity, or remote updates.

As regulatory expectations continue evolving, manufacturers should monitor CRA implementation guidance, harmonized standards development, and related cybersecurity requirements that may affect product testing, documentation, certification, and market access.

Building on Previous Washington Laboratories Coverage

Washington Laboratories has previously covered cybersecurity developments affecting wireless communications and connected products. Mike Violette’s article, Cybersecurity Developments in Wireless Communications, provides additional background on the growing role of cybersecurity in wireless and communications technologies.

This CRA update continues that discussion by focusing on upcoming EU implementation dates and planning considerations for manufacturers developing connected products for the European market.

Related Resources

• Cybersecurity Developments in Wireless Communications
• Washington Laboratories Newsletter: EU Cyber Resilience Act Update
• Cyber Security for Product Compliance Webinar
• Updates to the RED 2025 Cyber-Security Requirements

How Washington Laboratories Can Help

Washington Laboratories provides accredited testing, engineering, and compliance services supporting EMC, wireless, telecommunications, safety, and product compliance programs. As cybersecurity requirements become more closely integrated with product compliance and market access strategies, manufacturers should consider how evolving regulations may affect their development, testing, documentation, and certification planning.

Manufacturers should begin evaluating cybersecurity requirements now to support future compliance planning, product development, and continued access to global markets.

Learn more:
www.wll.com

Note: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Manufacturers should review the applicable EU Cyber Resilience Act requirements and consult appropriate regulatory or legal resources when determining product-specific obligations.