Compliance Solutions

Cyber Resilience Act (CRA)

Navigating the CRA within the Automotive Industry

The Cyber Resilience Act (CRA) aims to strengthen security systems in this connected era.

The Cyber Resilience Act or CRA is a legal framework that outlines cybersecurity requirements for hardware and software with digital and connected elements marketed in the European Union.

The EU adopted the Cyber Resilience Act (CRA) in October 2024, which went into force in December 2024.

While automotive vehicles are excluded due to the overlapping nature of regulations (like the WP.29 R155) automotive components with digital elements, as well as other commercial vehicles like agricultural machinery, do fall under the CRA.

Affected Industries

Construction & Agricultural Vehicles

Automotive components with digital elements, including those in construction vehicles and agricultural machinery, do fall under the CRA. With the development of autonomous technology, manufacturers and parts suppliers must comply in order to minimize security risks.

Defense & Security

Military and defense vehicles’ security updates are critical, as they are responsible for national security issues that are often time-sensitive. They must continuously apply security patches and updates to remain resilient in the case of cyber attacks.

Cloud & IT Infrastructure

Most companies and institutions now maintain their data and services through the cloud, where risk of data breach and service interruption is an important issue. The CRA requires cloud service providers and IT infrastructure companies to establish a rapid response system in the event of a security incident.

Robotics & Smart Factory

Many factories now utilize automation systems and IoT, and if hacked, the consequences can be catastrophic. The CRA requires manufacturers and operators to maintain security systems to protect the supply chain.

CRA Overview

The CRA went into force in 2024, and main obligations will apply from December 11, 2027, which provides organizations with 3 years to adapt to the new requirements

Security by Design

Mandating manufacturers to design products with cybersecurity in mind, integrating security measures to maintain robust safeguards.

Vulnerability Management and Updates

Manufacturers must establish and maintain a process for identifying, reporting, and mitigating vulnerabilities. They must provide security updates for a minimum period after the product’s market release or EOL.

Compliance and Documentation

Manufacturers are required to prepare comprehensive documentation that demonstrates compliance.

Without proper compliance, many companies will increase their risk of cyberattack due to vulnerabilities to their products, which will ultimately result in financial and legal burden.

Fines and legal sanctions

Companies that violate the CRA may be fined up to €15 million, which will increase the operation costs and financial burden.

Market restrictions and mandatory recalls

Products that do not comply with the CRA may be restricted from sale in the EU, which will reduce market share and brand awareness in the region, as well as worldwide.

Increased risk of cyber attacks

Failure to meet security requirements will increase likelihood of cyber attack, which can lead to operational disruptions and financial loss, as well as customer distrust.

Why Autocrypt?

AUTOCRYPT, leader in automotive cybersecurity regulatory compliance

With years of experience in helping clients stay ahead of cybersecurity regulations, AUTOCRYPT offers state-of-the-art solutions as well as an experienced consulting team to customize compliance and homologation.

Comprehensive, customized testing with attack simulations and tailored mitigation strategies
Customized consulting with security experts, including award-winning Red Team
Scalable, end-to-end security solutions for PBVs, smart factories, defense vehicles, and cloud and network environments

How We Help

The CRA spans various industries, so companies must establish a systematic strategy to compliance. AUTOCRYPT assists our partners and customer to go beyond simply meeting requirements, to prevent actual security threats by building the most secure digital environment from the beginning.