From September 2026, the Cyber Resilience Act (CRA) will come into force. It defines uniform security requirements for hardware and software products placed on the EU market. The aim is to increase the cyber resilience of products, minimize risks for end customers, and strengthen the protection of critical infrastructures. For companies that use or provide software or hardware, this means significant changes – both in terms of compliance and their own IT security strategy.

1. Who is affected by the CRA?

The CRA primarily targets:

Key requirements:

Companies distributing or using products under EU law must therefore ensure that the software and hardware they use are CRA-compliant.

2. Core requirements of the Cyber Resilience Act

The CRA defines clear security requirements for products:

Companies that secure their systems with solutions supporting access control, audit trails, and secure software delivery can already cover many CRA requirements today.

3. Securing the software supply chain

A central topic of the CRA is the security of the software supply chain. Many security incidents occur because third-party components are compromised. The new requirements include:

Companies that implement solutions ensuring SBOM integrity and strictly controlling access rights meet a core requirement of the CRA.

4. Supply chain security in practice

The CRA requires companies to systematically manage supply chain risks, including:

Companies using platforms that monitor and document the entire supply chain can quickly demonstrate CRA compliance.

5. Reporting security incidents

Under the CRA, there is a mandatory reporting deadline for security incidents for manufacturers. The goal is to detect and address vulnerabilities early, before end customers are affected.

Companies benefit from tools that enable automated detection and reporting of incidents, helping them meet legal deadlines.

6. Benefits for companies

Companies using CRA-compliant products gain several advantages:

7. Recommendations for 2026

By using solutions that cover these points, companies are well prepared for the CRA.

8. How KOBIL solutions support companies with the CRA

Companies face the challenge of providing software and hardware products transparently, securely, and CRA-compliant. KOBIL solutions help organizations by ensuring the integrity of Software Bills of Materials (SBOMs), controlling access rights to critical source code, and documenting changes traceably. They enable centralized monitoring of security incidents and simplify timely reporting to authorities. Through these measures, companies can protect their software supply chains, meet compliance requirements, and significantly reduce the risk of cyberattacks without adding operational complexity.

Conclusion

The Cyber Resilience Act significantly tightens requirements for software and hardware providers. For companies, this means greater transparency, more responsibility, and the need to continuously monitor supply chains and software. In practice, organizations that already implement systems securing SBOMs, controlling access rights, and centrally reporting security incidents are well positioned to meet the CRA’s demands.