Complying with the CRA (Cyber Resilience Act) for AI Products and IoT Products
Cybersecurity is a mandatory cybersecurity requirement for products with digital elements. Enterprise security is now both a product design and post-deployment priority.
CRA Compliance for AI Products
The EU Cyber Resilience Act (CRA) establishes a unified cybersecurity framework for digital products placed on or sold within the European Union. It ensures products with digital elements are secure by design, by default, and throughout their development lifecycle.
For AI products, CRA compliance is especially critical. Whether your AI system is embedded in hardware, delivered as standalone software, or integrated into a larger digital service, the CRA applies if it has network connectivity or processes data.
CRA shifts cybersecurity from internal practices to a legal obligation requiring AI product manufacturers and vendors to proactively manage cyber risks from development through post-market operations.
Key Pillars of CRA Compliance for AI Products
CRA compliance for AI products is built around several foundational pillars.
Security by Design and by Default
AI products must be designed with cybersecurity controls embedded from the earliest development stages. It cannot be added at a later stage as patches or workarounds.
Risk-Based Cybersecurity Controls
Security measures must reflect the level of risk posed by the AI product, including its intended use, deployment environment, and potential impact if compromised.
Lifecycle Security Management
Cybersecurity responsibilities extend beyond product launch, covering updates, vulnerability management, and long-term maintenance, such as customer support/warranty.
Transparent Documentation
Manufacturers must clearly document security features, limitations, and usage requirements to support safe deployment and regulatory oversight.
Supply Chain Accountability
Third-party components, open-source libraries, and AI dependencies must be assessed and managed as part of overall product security.
Core Obligations for Companies
Under the CRA, companies distributing AI products must build security and compliance into product development and maintenance post launch.
Below is a table outlining CRA Compliance pillars as well as supporting evidence that can be submitted to satisfy each compliance section.
| Scoping & Applicability | Inventory of products with digital elements; classification documentation | Applicability assessment report |
|---|---|---|
| Risk Assessment | Cybersecurity risk assessment reports, threat models | Risk analysis testing and threat modeling |
| Security by Design & Default | Secure development policies across product lifecycle, architectural security documentation | Secure code reviews and design validation |
| Vulnerability Management | Vulnerability handling procedures; AI Software Bill of Materials (AISBOM) | Vulnerability scanning & lifecycle testing |
| Incident Reporting Preparedness | Incident response plans; reporting checklists | Tabletop and live incident response exercises |
| Technical File & Conformity Documentation | Technical file including SBOMs, build logs, CE declaration of conformity | Conformity assessment (self or third-party) |
| Product Testing & Certification | Test report summaries; certification evidence | Security testing (automated & manual); external certification if required |
| Post-Market Surveillance & Updates | Patch, update and monitoring logs; customer support change records | Regression testing for updates; ongoing compliance checks |
The obligations above apply to manufacturers, importers, and distributors, depending on their supply chain role in bringing the AI product to market.
CRA and IoT Products
[Insert graphic of different types of IoT products]
The Cyber Resilience Act (CRA) also relevant to IoT products. As the CRA sets mandatory cybersecurity requirements for any product with digital elements, this includes most IoT devices such as hardware, software and related connected services.
Under the CRA, IoT manufacturers are responsible for ensuring their products are secure throughout their entire lifecycle, not just at launch.
The exact same CRA pillars for AI products apply to IoT products including security by design, risk-based security controls, vulnerability management, incident reporting and technical documentation.
Because many IoT devices are widely deployed, hard to update, and connected to critical systems, the CRA is yet another EU regulation that these products must meet.
For IoT companies, compliance is not just a legal requirement. CRA will impact product design, update mechanisms, supply chain choices, and long-term support models. Getting this right early improves product trust but avoids costly redesigns or market access restrictions later.
Timeline of CRA Regulation & Enforcement
.jpg?width=900&height=506&name=NEW%20-%20CRA%20Implementation%20Timeline%20(2024-2027).jpg)
The Cyber Resilience Act (CRA) was approved in 2024 but will not come in full enforcement until December 2027. This gives enterprises a grace period timeline to prepare for compliance.
- 2024 – CRA formally adopted at the EU level
- 2025 – Regulation enters into force; transition period begins
- September 11, 2026 – Vulnerability handling, incident reporting, and conformity preparation ramps up. Manufacturers will be required to notify the European Union Agency for Cybersecurity (ENISA) and Member State authority of actively exploited vulnerabilities and severe incidents affecting in-scope products. This notification must be made without undue delay, and in any event within 24 hours of the manufacturer becoming aware of the vulnerability or incident.
- December 11, 2027 – Full CRA compliance becomes mandatory for products placed on the EU market.
The 2024 to 2027 transition window gives AI product teams time to align development, security, and compliance processes.
Summary
The Cyber Resilience Act represents a major change in how cybersecurity is regulated for AI products in the EU. Compliance is no longer optional or an afterthought. It is a core product requirement, meaning cybersecurity must be built into product design from the start.
For AI companies, meeting CRA obligations means designing products with security in mind, managing AI risks on an ongoing basis, and providing documentation proving accountability and transparency. By meeting compliance, you gain trust with customers, safeguard sensitive data, and protect the company's reputation. Preparing early not only reduces regulatory risk, but also builds stronger, more trusted products and positions products for long-term adoption in the EU market.
For comprehensive guidance on implementing AI management systems that support CRA compliance, including ISO 42001 AI cybersecurity frameworks, organizations can benefit from structured approaches to lifecycle security management and risk assessment.