Cyber Resilience Act for electronics embedded systems and IoT
The CRA makes cybersecurity a product responsibility. Solvetronix supports manufacturers and OEMs from regulatory assessment through technical implementation to documented evidence. We support critical infrastructure operators in assessing manufacturer information, updates and retrofit options.
Our services cover regulatory advice, technical analysis and implementation, and evidence for your product.
Request a CRA readiness checkYour starting point
For manufacturers and OEMs
Which components are inside your product? How do security updates reach devices in the field? What evidence supports a release? We connect firmware analysis and secure development with SBOMs, vulnerability handling and technical documentation.
Assess the CRA requirements for your productFor critical infrastructure operators
You need reliable manufacturer information, manageable updates and secure options for equipment with long service lives. We support the technical assessment of procurement, continued operation and retrofit, helping you distinguish product responsibilities from operator obligations.
Critical infrastructure and NIS2Which products should you assess
The CRA generally covers hardware and software products made available on the EU market where the intended purpose or reasonably foreseeable use includes a direct or indirect data connection. This can include controllers, IoT devices, gateways and components marketed separately. Classification depends on the individual product and applicable exclusions.
An internet connection is not essential. Connections to other devices may also be relevant. For an IoT system, the product boundary also needs to address firmware, applications and manufacturer-responsible backend elements that are necessary for a product function.
The deadlines
Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and severe incidents under Article 14. This obligation also covers products placed on the market before that date.
The main obligations apply from 11 December 2027, including security requirements, vulnerability handling, technical documentation and conformity assessment. For products placed on the market earlier, it is particularly important to assess whether they undergo a substantial modification from that date.
Seven topics for your product work
Scope and roles — define the product boundary, branding and responsibilities.
Firmware and secure development — translate risks into technical measures.
SBOM and supply chain — link components to the delivered product version.
Reporting and PSIRT — turn technical findings into timely decisions.
Conformity and CE — connect core functionality, assessment route and evidence.
Support updates and retrofit — support the installed base throughout its lifecycle.
Critical infrastructure and NIS2 — connect product obligations with secure operation.
Technical implementation and regulatory advice
Solvetronix analyses the defined product and agreed version. We prioritise technical gaps and implement the agreed measures. Depending on the project, deliverables include an SBOM, firmware test report, update architecture and technical product documentation.
Solvetronix works with you to clarify regulatory scope, roles and obligations, the conformity route and reporting process requirements. Technical findings and regulatory assessment refer to the same product version.
Evidence stays linked to hardware revision, firmware and release. You can see which finding has been addressed, which limitation remains and who decides the next action. Any required assessment by a notified body is planned separately.
Frequently asked questions
What is the right next step for your product
Tell us about your product, its current development or operational status and your main open question. We will identify the information needed for an initial technical assessment.
Request a CRA readiness checkLegal basis and sources
- Cyber Resilience Act — Regulation (EU) 2024/2847
- European Commission — CRA overview and dates
- European Commission — CRA implementation guidance
General information and technical guidance. The specific assessment depends on the product, role and use. Reviewed 22 October 2026.