EU Cyber Resilience Act
Clear guidance for industrial automation compliance
Understand what's required, when it's required, and how FLECS helps you get there. Based on official EU sources, with clear timelines and actionable steps.
What is the EU Cyber Resilience Act?
The Cyber Resilience Act (CRA) is an EU regulation that establishes mandatory cybersecurity requirements for all products with digital elements sold in the European Union.
Entered into force10 December 2024
Full enforcement11 December 2027
Applies toHardware & software with network connectivity
ScopeManufacturers, importers & distributors
What's new
Unlike previous regulations, the CRA requires:
- Security by design throughout the product lifecycle
- Mandatory vulnerability reporting within 24 hours
- Software Bill of Materials (SBOM) for all products
- CE marking for cybersecurity compliance
Who's affected
Industrial automation products are explicitly in scope:
The 21 Essential Requirements
CRA Annex I defines the essential cybersecurity requirements that products with digital elements must address by December 2027. It applies to all products placed on the market after that date, including legacy products that continue to be sold.
| Ref | Requirement | Summary |
|---|---|---|
| I.1 | No known vulnerabilities | Ship without exploitable vulnerabilities |
| I.2 | Secure by default | Secure configuration out of the box |
| I.3 | Minimal attack surface | Only necessary components enabled |
| I.4 | Data protection | Encrypt data at rest and in transit |
| I.5 | Secure communications | TLS and encrypted protocols |
| I.6 | Access control | Authentication and authorization |
| I.7 | Integrity protection | Detect unauthorized modifications |
| I.8 | Security logging | Audit trails for security events |
| I.9 | Recovery capability | Backup and restore functions |
| I.10 | Network isolation | Don't compromise other systems |
| I.11 | Minimal interfaces | Reduce exposed attack vectors |
| I.12 | Incident containment | Limit breach impact |
| I.13 | Monitoring opt-out | User control over telemetry |
Product Classification
The CRA categorizes products based on cybersecurity risk. Your category determines the conformity assessment procedure required.
Article 32(1)
Conformity AssessmentSelf-assessment (Module A)
Products not listed in Annex III or IV. Manufacturers can self-declare conformity using internal control procedures.
Industrial Automation Examples
- Basic HMI panels
- Simple sensors
- Data loggers
- Industrial monitors
- Basic edge devices
Annex III, Part I
Conformity AssessmentHarmonised standards or third-party
If harmonised standards exist and are applied, self-assessment is permitted. Otherwise, third-party assessment required.
Industrial Automation Examples
- Identity management systems
- VPN devices & software
- Network management systems
- SIEM systems
- Update/patch management tools
Annex III, Part II
Conformity AssessmentThird-party required
Mandatory third-party conformity assessment by notified bodies. No self-assessment option regardless of standards.
Industrial Automation Examples
- Hypervisors & container runtimes
- Industrial firewalls
- Intrusion detection/prevention
- Tamper-resistant microcontrollers
- Secure elements in machinery
Annex IV
Conformity AssessmentEuropean cybersecurity certification
Products for critical infrastructure. Require certification under EU cybersecurity certification schemes (Regulation 2019/881).
Industrial Automation Examples
- Hardware Security Modules (HSMs)
- Smart meter gateways
- Secure elements for critical systems
- Smartcard readers for infrastructure
Not sure about your classification?
Take our quick assessment based on CRA Article 6 and Annexes III/IV to determine your likely product category.
Software Bill of Materials (SBOM)
The CRA requires manufacturers to maintain an SBOM—a complete inventory of software components in your product.
CRA SBOM Requirements
Annex I, Part II (1)Machine-readable formatSPDX, CycloneDX, or SWID tags
Top-level dependenciesMinimum requirement for component listing
Authority accessMust provide to market surveillance on request
Not publicly requiredInternal documentation, not public disclosure
Why it matters for industrial automation
Your products likely include open source components, third-party libraries, and firmware dependencies. The SBOM traces:
- What components are included
- What versions are deployed
- Known vulnerabilities in those components
- License compliance status
FLECS Platform
SBOM Capabilities
Automated component inventoryContinuous scanning and cataloging of all software dependencies
SPDX 2.3 format exportIndustry-standard format ready for regulatory submission
Vulnerability database integrationAutomatic matching against CVE and security advisories
Continuous CVE monitoringReal-time alerts when new vulnerabilities affect your components
Ship CRA Compliant Products Faster
Integrated device management, central services, and automated compliance workflows.
On the Device
ActiveManaged Operating SystemMaintained, update-capable OS with defined update channels
App Lifecycle ManagementInstallation & maintenance of apps with fully automated lifecycle management
Security by DesignRBAC & certificate-based communication built into FLECS Core
App EcosystemAccess to 60+ standard apps for rapid controller extension
Central Service Portal
ActiveDownload PortalTools, drivers & firmware for all systems
License ManagementLicense provisioning & activation
Order ManagementCentralized procurement & fulfillment
Structured DistributionSupport for existing update processes
Automated ReleaseTest & release apps with fully automated CI/CD pipeline
Compliance Management
In DevelopmentSBOM IntegrationUse of customer-side Software Bills of Materials
CVE ScanningAutomated vulnerability scanning & risk analysis
Update NotificationsAlerts & controlled update processes via central profiles
CRA Annex I Requirements
How FLECS addresses each requirement| Ref | Requirement | Summary |  FLECS |
|---|---|---|---|
| I.1 | No known vulnerabilities | Ship without exploitable vulnerabilities | Coming soonCVE scanning planned |
| I.2a | Secure by default | Secure configuration out of the box | Covered |
| I.2b | Minimal attack surface | Only necessary components enabled | Covered |
| I.2c | Data protection | Protect stored data appropriately | Covered |
| I.2d | Secure communications | Encrypted data in transit | Covered |
| I.2e | Access control | Authentication and authorization | Covered |
| I.2f | Integrity protection | Detect unauthorized modifications | Coming soon |
| I.2g | Security logging | Audit trails for security events | BetaNearly complete |
| I.2h | Recovery capability | Backup and restore functions | Covered |
| I.2i | Network isolation | Don't compromise other systems | Covered |
| I.2j | Minimal interfaces | Reduce exposed attack vectors | Covered |
| I.2k | Incident containment | Limit breach impact | Covered |
| I.2l | Monitoring opt-out | User control over telemetry | Covered |
| II.1 | SBOM documentation | Machine-readable component inventory | Coming soonSBOM integration planned |
| II.2 | Separate security patches | Decouple security from features | Covered |
| II.3 | Security testing | Regular pentests and assessments | Coming soon |
| II.4 | Vulnerability disclosure | Publish fixed vulnerabilities | Coming soon |
| II.5 | Disclosure policy | Process for security reports | Coming soon |
| II.6 | ENISA communication | 24h reporting to EU agency | Coming soon |
| II.7 | Signed updates | Cryptographic verification | Coming soon |
| II.8 | Free security updates | No charge for patches | Covered |
Everything You Need to Understand the CRA
Curated resources from official EU sources, the Linux Foundation, and industry standards bodies.
From FLECS
CRA Requirements Checklist
All 21 essential requirements from Annex I in a clear, actionable format. Track your compliance progress step by step.
Download Checklist
Product Classification Quiz
Answer 5 quick questions to determine your product category and required conformity assessment procedure.
Take the Quiz
CRA Compliance Whitepaper
Deep-dive into compliance strategies, timelines, and best practices from industry experts.
Read the Whitepaper
Community & Official Resources
Trusted sources from the open source security communityUnderstanding the EU CRA
Official 90-minute training covering CRA requirements and compliance strategies.
Free CourseOpen Regulatory Compliance WG
Community resources, standards inventory, and collaborative compliance tools.
CommunitySBOM Standards Catalog
Comprehensive guide to SBOM formats, tools, and implementation best practices.
ReferenceReferenced StandardsView full CRA text
IEC 62443Industrial Automation SecurityAnnex I alignment
SPDX / CycloneDXSBOM FormatsPart II (1) requirement
BSI TR-03183German SBOM GuidelineImplementation
ENISA MappingStandards AlignmentVerification
CRA Compliance Questions
Answers to the most common questions about the Cyber Resilience Act and how it applies to your products.
Insights into CRA compliance readiness
Learn what it takes to achieve Cyber Resilience Act conformity for industrial automation products in this comprehensive guide based on official EU requirements and industry best practices.
Ready to learn more?
See how FLECS simplifies CRA compliance for industrial automation manufacturers with built-in security updates, automated vulnerability tracking, and ready-to-use conformity documentation.
Professional services
Discover how FLECS Integration experts can help you launch new industrial automation solutions quickly and effectively.