Cyber Resilience Act
Cyber Resilience Act (Regulation (EU) 2024/2847)
The Cyber Resilience Act sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market, covering design, development, and vulnerability handling for the product's support period. It entered into force on 10 December 2024. Manufacturers' reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027.
Who it applies to
Manufacturers, importers, and distributors of products with digital elements made available in the EU, including software, connected devices, and their remote data processing, wherever the manufacturer is based. Identity management systems, privileged access management software and hardware (including biometric readers), and password managers are listed as Class I important products.
Identity requirements
- Ensure protection from unauthorised access by appropriate control mechanisms, including authentication, identity or access management systems
- Report on possible unauthorised access to the product
- Place products on the market with a secure by default configuration, with the possibility to reset to the original state
- Protect the confidentiality and integrity of stored, transmitted, or processed data, for example by encryption
- Notify actively exploited vulnerabilities and severe incidents to the coordinator CSIRT and ENISA, with an early warning within 24 hours
- For Class I identity, PAM, and password manager products, apply harmonised standards or a certification scheme in full, or undergo third-party conformity assessment
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | Requires appropriate authentication and access control mechanisms to protect products from unauthorised access, and secure by default configuration. |
| Privileged access (PAM) | Lists privileged access management software and hardware as Class I important products subject to stricter conformity assessment. |
| Identity governance (IGA) | Lists identity management systems as Class I important products, bringing IAM vendors directly into scope. |
| Breach notification | Requires a 24-hour early warning and a 72-hour notification for actively exploited vulnerabilities and severe incidents, via the single reporting platform. |
| Audit, logging & accountability | Requires products to report on possible unauthorised access and manufacturers to keep technical documentation demonstrating conformity. |
Penalties
Non-compliance with the essential cybersecurity requirements or the obligations in Articles 13 and 14 can incur fines of up to 15 million euros or 2.5 percent of total worldwide annual turnover, whichever is higher, with lower tiers for other breaches.
Cyber Resilience Act: frequently asked questions
- When does the Cyber Resilience Act apply?
- It entered into force on 10 December 2024. The reporting obligations in Article 14 apply from 11 September 2026, the rules on conformity assessment bodies from 11 June 2026, and the rest of the Regulation from 11 December 2027.
- Does the CRA require authentication in products?
- Yes. Annex I requires products to ensure protection from unauthorised access by appropriate control mechanisms, including authentication, identity or access management systems, and to ship with a secure by default configuration.
- Are identity and access management products covered?
- Yes. Annex III lists identity management systems, privileged access management software and hardware, including biometric readers, and password managers as Class I important products, which face stricter conformity assessment.