Future-proof your products

Cybersecurity begins with product development

Obtain advice now with no obligation

CRA White Paper

Get a concise guide to the requirements of the Cyber Resilience Act (CRA). This white paper provides a structured overview of the key topics, ranging from product classification and manufacturers’ obligations through to reporting requirements, compliance and the next steps to take.

Cybersecurity is now a must. Connected products must comply with the requirements of the extended RED standard (RED Security) and the new EU-Cyber Resilience Act (CRA). The key requirements of the CRA will come into force in December 2027. The challenge is that the requirements are complex and time is running out.

STEINEL Solutions supports companies in the practical implementation of these requirements. We guide you every step of the way, from the initial analysis and assessment of regulatory requirements right through to CE marking and beyond.

What are CRA and the RED standard (RED security)?

Cyber Resilience Act (CRA) – EU 2024/2847

Applies to products with digital elements and communication interfaces (hardware and software)
Requirements: risk management, vulnerability management, security updates, SBOM, CE marking
Products placed on the market before 11 December 2027 are exempt
Products that receive subsequent updates are affected

RED standard – Directive 2014/53/EU + Delegated Act 2022/30/EU

Applies to radio equipment with direct or indirect internet connection
Hardware products, including relevant software and firmware
Requirements: Protection against network damage, data protection, fraud protection
Harmonised standards: EN 18031-1 / EN 18031-2 / EN 18031-3
Mandatory application from 1 August 2025

Who is this relevant for?

Product manager

You must ensure that new products are developed in compliance with regulations.

Development teams

You need clear requirements and technical standards.

Decision-maker

You are responsible for product safety and liability.

Companies with existing products

Updates may lead to CRA obligations.

Our expertise – your advantage

We help you to make your products legally compliant and safe, while keeping your development goals in mind.

Knowledge

In-depth knowledge of CRA and RED Security

Consultancy

Target group-oriented consulting for developers, product managers and decision-makers

Accompaniment

Support from analysis to CE marking

Experience

Experience from successful projects

Ramon Schenk, Project Manager at STEINEL Solutions AG

"RED 3.3 and the upcoming CRA mark the beginning of a new era for software and hardware development. The multitude of requirements can seem overwhelming, but we see it as an opportunity to develop safer and more future-proof devices for our customers.
By considering these requirements early on in the project initialisation phase (e.g. risk analysis and concept phase), we maintain a clear view of the solution and proceed step by step."

Robin Bolt, electronics and firmware developer at STEINEL Solutions AG

"Our IoT development includes not only radio, EMC and electrical safety, but also cybersecurity: security by design, thread/risk assessments, and regular security-critical software updates on IoT devices after SBOM checks.
This means that your products are not only innovative, but also trustworthy and protected in the long term."

Technical requirements

Protection against unauthorised access: access control, authentication, encrypted communication
SBOM (Software Bill of Materials)
Risk analysis and security testing
Incident response and update policies
CE marking with cybersecurity component

Procedural requirements

Vulnerability management

Integration into PEP (product development process)

Reporting authorities: ENISA, BSI

Lifecycle support

Product classification & proof of conformity

There are various classifications. The classification affects the type of proof of conformity required.

It is therefore important to determine the product’s classification.

Overview of deadlines

10 December 2024

CRA comes into force

1 August 2025

RED Delegated Act mandatory

11 September 2026

CRA reporting obligation for manufacturers

11 December 2027

CRA fully applicable

Risks of delayed implementation

Delayed market access, failed certification, increased product liability risks
Higher development costs, lack of safety documentation, damage to reputation

What happens in the event of non-compliance?

Fine: up to 2.5% of global annual turnover (max. EUR 50 million)
Product recall, sales ban, public notification of violations

How we support you

CRA/RED impact assessment
Gap Analysis
Security risk assessment
Threat modelling
Secure development process (PSLC)

Get in touch

SBOM strategy
Vulnerability management process
Security requirements analysis
Technical documentation
Support with certification