Risk assessment and Annex I

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, gives the essential cybersecurity requirements in Annex I. Annex I has these parts:

Part I, point (1): "an appropriate level of cybersecurity based on the risks" for all products with digital elements.
Part I, point (2): thirteen requirements, from (a) to (m). They apply "On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable". Only point (2) has this condition.
Part II: the vulnerability handling requirements for manufacturers. For Part II, see Vulnerability handling and the support period.

The cybersecurity risk assessment of Article 13(3) tells the manufacturer how to apply each of these parts.

Manufacturers' Article 13 and Annex I obligations apply from 11 December 2027, subject to the transitional provisions of Article 69 (Article 71(2)).

The persons considered to be a manufacturer in Articles 21 and 22 are subject to CRA Articles 13 and 14. The Article 22(2) rules for part or all of the product apply only to persons in Article 22(1).

The cybersecurity risk assessment — Article 13(2) to (4)

Article 13(1) of the CRA gives this obligation of the manufacturer: "When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I."

To comply with Article 13(1), Article 13(2) tells the manufacturer to:

do a cybersecurity risk assessment of the product
"take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements"

Article 13(2) also tells the manufacturer to do these two steps "with a view to minimising cybersecurity risks, preventing incidents and minimising their impact, including in relation to the health and safety of users".

Article 13(3) gives these rules for the cybersecurity risk assessment:

It must be "documented and updated as appropriate during a support period".
It must include "at least an analysis of cybersecurity risks based on the intended purpose and reasonably foreseeable use, as well as the conditions of use, of the product with digital elements, such as the operational environment or the assets to be protected, taking into account the length of time the product is expected to be in use".
It must "indicate whether and, if so in what manner, the security requirements set out in Part I, point (2), of Annex I are applicable to the relevant product with digital elements and how those requirements are implemented as informed by the cybersecurity risk assessment".
It must also "indicate how the manufacturer is to apply Part I, point (1), of Annex I and the vulnerability handling requirements set out in Part II of Annex I".

The manufacturer also uses this length of time when it sets the support period (Article 13(8)). For the support period, see Vulnerability handling and the support period.

Article 13(4) adds these rules:

"When placing a product with digital elements on the market, the manufacturer shall include the cybersecurity risk assessment referred to in paragraph 3 of this Article in the technical documentation required pursuant to Article 31 and Annex VII." For the technical documentation, see Technical documentation.
"Where certain essential cybersecurity requirements are not applicable to the product with digital elements, the manufacturer shall include a clear justification to that effect in that technical documentation."
"For products with digital elements as referred to in Article 12, which are also subject to other Union legal acts, the cybersecurity risk assessment may be part of the risk assessment required by those Union legal acts."

Article 12 applies only to products with digital elements in the scope of the CRA that are "classified as high-risk AI systems pursuant to Article 6" of Regulation (EU) 2024/1689 (the EU AI Act). Thus the rule in Article 13(4) for Article 12 products does not apply to all products that use AI. For Article 12, see Article 12 — High-risk AI systems.

Recital 55 of the CRA is about a requirement that does not apply to the product. Where the manufacturer "has identified cybersecurity risks in relation to that essential cybersecurity requirement, it should take measures to address those risks by other means". Recital 55 gives two examples: "by limiting the intended purpose of the product to trusted environments or by informing the users about those risks".

Annex I, Part I, point (1) and Article 6

At placing on the market, the manufacturer must make sure the product complies with Annex I, Part I, point (1) of the CRA (Article 13(1)): "Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks." Point (1) does not have the condition "where applicable" of point (2).

Article 6 of the CRA gives the conditions to make a product with digital elements available on the market. All of these conditions are necessary:

Products with digital elements shall be made available on the market only where:
(a) they meet the essential cybersecurity requirements set out in Part I of Annex I, provided that they are properly installed, maintained, used for their intended purpose or under conditions which can reasonably be foreseen, and, where applicable, the necessary security updates have been installed; and
(b) the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Part II of Annex I.

Thus point (a) of Article 6 applies to the product, and point (b) applies to the vulnerability handling processes of the manufacturer.

Annex I, Part I, point (2) — the thirteen requirements

At placing on the market, the manufacturer must make sure the product complies with Annex I, Part I of the CRA (Article 13(1)). Point (2) starts with: "On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:".

Point	Products with digital elements must:
(a)	"be made available on the market without known exploitable vulnerabilities"
(b)	"be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state"
(c)	"ensure that vulnerabilities can be addressed through security updates, including, where applicable, through automatic security updates that are installed within an appropriate timeframe enabled as a default setting, with a clear and easy-to-use opt-out mechanism, through the notification of available updates to users, and the option to temporarily postpone them"
(d)	"ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access"
(e)	"protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means"
(f)	"protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions"
(g)	"process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (data minimisation)"
(h)	"protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks"
(i)	"minimise the negative impact by the products themselves or connected devices on the availability of services provided by other devices or networks"
(j)	"be designed, developed and produced to limit attack surfaces, including external interfaces"
(k)	"be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques"
(l)	"provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user"
(m)	"provide the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner"

In point (a), an exploitable vulnerability is "a vulnerability that has the potential to be effectively used by an adversary under practical operational conditions" (Article 3(41)).

The condition at the start of point (2) applies to each of the thirteen requirements. Thus "unless otherwise agreed between manufacturer and business user" is not the only condition in which point (b) does not apply. When a requirement does not apply to the product, Article 13(4) tells the manufacturer to include a clear justification in the technical documentation.

Components — Article 13(5) to (7)

The CRA gives the manufacturer these obligations for the components of its product with digital elements:

Due diligence (Article 13(5)): the manufacturer must "exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements". This also applies to components of free and open-source software "that have not been made available on the market in the course of a commercial activity".
A vulnerability in a component (Article 13(6)): the obligation starts "upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements". The manufacturer must "report the vulnerability to the person or entity manufacturing or maintaining the component". The manufacturer must also "address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I".
A change that the manufacturer makes for that vulnerability (Article 13(6)): "Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format."
Records (Article 13(7)): the manufacturer must "systematically document, in a manner that is proportionate to the nature and the cybersecurity risks, relevant cybersecurity aspects concerning the products with digital elements, including vulnerabilities of which they become aware and any relevant information provided by third parties". The manufacturer must also, "where applicable, update the cybersecurity risk assessment of the products".

A product with digital elements includes its remote data processing solutions (Article 3(1)).

Article 14 can also apply to a vulnerability in a component from a third party. For the conditions, see Reporting obligations of manufacturers.

Full quality assurance

For the CRA module H procedure, the manufacturer must do all of these (Annex VIII, Part IV, point 2):

Operate "an approved quality system as specified in point 3 for the design, development and final product inspection and testing of the products with digital elements concerned and for handling vulnerabilities".
"maintain its effectiveness throughout the support period"
"be subject to surveillance as specified in point 4"