The EU’s Cyber Resilience Act (CRA) 2024 lays down a “legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market” (CRA, 1). These requirements cover “products with digital elements”. The goal is to establish conditions for developing secure software. Software venders must take security seriously thought the entire SDLC. Consequently, the intention is that “hardware and software products are placed on the market with fewer vulnerabilities and that manufacturers take security seriously throughout a product’s lifecycle” (CRA, 2). 

This blog post will answer some basic questions, based on our understanding of the Act. What is the new Cyber Resilience Act in the EU? What is the key focus of the Cyber Resilience Act and who does it affect? When will the EU Cyber Resilience Act come into force? How do software venders comply with its requirements? Are there obligations for other parties too? And does Payara help its customers to comply with their requirements under the Act?