How to Comply with the Cyber Resilience Act Before December 2027

Reporting obligations under the EU Cyber Resilience Act went live on 11 September 2026. The rest of the regulation applies from 11 December 2027. That leaves roughly fourteen months, and for a hardware manufacturer that is not a long runway. Firmware architecture decisions, secure update mechanisms and support commitments all have lead times measured in product cycles rather than quarters.

The work splits cleanly into two tracks: what the product must do, and what the organization must be able to prove. Industrial manufacturers tend to be further along on the first than the second. A controller built to IEC 62443 already meets a good deal of what the CRA asks of a product. The gap is usually documentation, vulnerability handling process and the support period commitment.

The dates that structure the plan

Date	What changes
10 December 2024	Regulation entered into force. The clock started.
June 2026	Conformity assessment bodies could begin to be notified, which is when third-party capacity started to exist.
11 September 2026	Article 14 reporting obligations became mandatory and enforceable.
Late 2026	Core harmonized standards expected. These are what make self-assessment straightforward.
11 December 2027	Full application of the remaining provisions, including conformity assessment and CE marking.

 

The harmonized standards risk Self-assessment is far simpler when you can declare conformity against a harmonized standard. Those standards were expected in late 2026 and any slippage compresses the window for everyone at once. Planning on the assumption that they arrive late, and designing against the essential requirements directly, is the safer posture. It also means your evidence survives whichever way the standards land.

 

Track one: what the product has to do

The essential cybersecurity requirements set out what a product with digital elements must deliver. For industrial equipment the demanding ones are consistent across clients:

• Secure by default configuration. Shipping with a documented default password is no longer a commercial decision. This is the single most common gap on legacy industrial product lines.
• No known exploitable vulnerabilities at the point of placement on the market. That is a release gate, and it needs component-level visibility to enforce.
• Secure update mechanism. Signed, verifiable updates that can be delivered without physical access where the product design allows it. Retrofitting this is the longest lead item on most roadmaps.
• Protection of data at rest and in transit. Proportionate to the product's function, which on a controller means engineering traffic and configuration data.
• Minimized attack surface. Services and ports off unless needed. Straightforward in principle, awkward on products with long installed bases.
• Logging and monitoring capability. The product must be able to record security relevant events. Our guide to building an OT monitoring program covers how that data is actually consumed.

Track two: what you have to be able to prove

Vulnerability handling runs for the support period, and the support period is a commitment you publish. The default expectation is at least five years unless the product's expected lifetime is genuinely shorter, which for industrial equipment is almost never the case. Over that period you need to:

• Maintain a software bill of materials covering at least the top level dependencies.
• Identify and document vulnerabilities in components, not only in your own code.
• Deliver security updates without charge and separately from feature releases.
• Run a coordinated disclosure policy with a working contact point.
• Keep technical documentation current, including the conformity assessment and the classification reasoning behind it.

That SBOM requirement is the one that unblocks everything else, and it is also where most industrial product lines start from nothing. Our practical guide to SBOM for OT supply chain and procurement covers generation, maintenance and what to ask suppliers for. Separating security updates from feature releases also has a direct operational benefit for your customers, which our guidance on OT patch management explains from the plant side.

A fourteen month sequence that works

Phase	Work
Months 1 to 3	Scope and classify every product line against route to market. Establish which role you hold in each supply chain. Decide what you will stop selling into the EU rather than remediate.
Months 3 to 6	Build the SBOM capability and run it across the portfolio. Gap assess each in-scope product against the essential requirements. This is where the real cost becomes visible.
Months 6 to 11	Engineering remediation. Secure defaults, update mechanism, attack surface reduction. Book notified body capacity now if any product sits in Class I or II.
Months 11 to 14	Conformity assessment, technical documentation, declaration of conformity and CE marking. Publish support periods and the disclosure policy.

 

The decision in the first phase is the one most teams defer and should not. Some legacy product lines will cost more to bring into conformity than the European revenue justifies. Making that call early frees engineering capacity for the products that matter.

What this gives you outside Europe

None of this work is wasted on North American customers. Secure defaults, signed updates, an SBOM and a published disclosure policy are what sophisticated US and Canadian buyers already ask for in procurement, and increasingly what their own regulators expect them to demand. Utilities working to NERC CIP supply chain requirements are asking vendors these questions today. The CRA simply sets a deadline on answers you were going to need anyway. Our OT security best practices guide covers the buyer side of the same conversation.

Why Choose Arista Cyber

We assess industrial products and the plants they run in, which is a combination most compliance consultancies cannot offer. Our teams work to IEC 62443 on product and system security and carry functional safety credentials on the same assets, so remediation advice accounts for what a change does to a safety case rather than treating security in isolation. We work with manufacturers, integrators and asset owners across the US, Canada and the Gulf. Our case studies show the pattern.

Next Steps

Fourteen months is enough time if the scoping is done now and engineering remediation starts in the first half of 2027. It is not enough time if the gap assessment waits for harmonized standards to publish. Start with scope and classification, build the SBOM, then let the gap assessment tell you what the engineering bill actually is.

Common Questions

How long is the support period we have to commit to?

The expectation is at least five years, unless the product's expected lifetime is genuinely shorter. For industrial equipment with fifteen or twenty year service lives, plan on longer rather than the minimum, and publish the period you can actually honor.

Do we have to provide security updates free of charge?

Yes, and separately from feature updates. Bundling a security fix into a paid release upgrade does not satisfy the obligation.

Can we self-assess, or do we need a notified body?

Most industrial products sit in the default tier and permit self-assessment. Products whose core function is network security or system management can require third-party assessment, and critical tier products require certification. Classification decides this, which is why it comes first.

Does IEC 62443 certification make us CRA compliant?

It does not discharge the obligation, but it covers a substantial part of the technical ground, particularly 62443-4-1 for the development process and 62443-4-2 for component requirements. Treat it as a strong head start on the essential requirements rather than a substitute for conformity assessment.

What if the harmonized standards are late?

Design and document against the essential requirements directly. That evidence remains valid whenever the standards land, and it avoids a compressed scramble if they publish close to the deadline.

Fourteen months, and the engineering work is the long pole. Arista Cyber builds CRA compliance roadmaps for industrial manufacturers in the US and Canada: scope and classification, SBOM capability, gap assessment against the essential requirements, and a sequenced remediation plan your engineering team can actually deliver. Build your CRA roadmap