Cyber Resilience Act (CRA) – what the EU’s new cyber rules mean for industrial networks
The switch in the control cabinet, the router for remote service and the industrial computer on the line are now ‘products with digital elements’ under EU law. The Cyber Resilience Act (CRA) sets requirements for how they are developed, updated and documented. Here we explain what applies, when it applies and what to ask for when you buy.
By Erik Ahlqvist, Managing Director of SCN · Updated 4 November 2026 · 7 min read- What: EU Regulation (EU) 2024/2847, which sets cybersecurity requirements for all hardware and software that can be connected to a network or to another device.
- Who is responsible: primarily the manufacturer. Importers and distributors must check the CE marking and documentation.
- When: reporting of actively exploited vulnerabilities has applied since 11 September 2026. The remaining requirements apply to products placed on the market from 11 December 2027.
- What you will notice: CE marking will cover cybersecurity, and every product will have a stated support period with security updates, normally at least five years.
- Switches and routers count as ‘important products’ (class I), firewalls as class II, with a requirement for third-party assessment.
What is the Cyber Resilience Act?
The CRA is the first EU law to set cybersecurity requirements directly for products, in the same way that the Low Voltage and EMC Directives set requirements for electrical safety and interference. The Regulation entered into force on 10 December 2024 and applies throughout the EU without member states having to pass their own laws.
It covers everything with ‘digital elements’ that can be connected to a network or another device: switches, routers, gateways, industrial computers, operator panels, connected sensors and the software supplied with them. There are exemptions for areas that already have their own rules, such as medical devices, motor vehicles, civil aviation and marine equipment.
The timeline
Products placed on the market before 11 December 2027 may continue to be sold and used. The manufacturer’s reporting obligation, however, already applies now, including to those products.
What does the CRA require of the manufacturer?
- Secure by design: a risk assessment, no known vulnerabilities on delivery, secure default settings with no default passwords, and protection of data and access.
- Vulnerability handling throughout the support period: security updates without delay, a contact point for reporting vulnerabilities and a list of the software components (SBOM).
- Support period: the manufacturer must state how long the product will receive security updates. It must reflect the expected time of use and is normally at least five years.
- Reporting: actively exploited vulnerabilities and severe incidents are reported to ENISA – an early warning within 24 hours, a notification within 72 hours and a final report after that.
- Documentation: technical documentation, an EU declaration of conformity and CE marking.
Fines can reach €15 million or 2.5 per cent of global turnover.
Class I, class II and critical products
Most products fall into the default category, where the manufacturer itself assesses whether the requirements are met. Products of greater importance for security are listed as ‘important products’.
| Category | Examples in industrial networks | Assessment |
|---|---|---|
| Default | Protocol gateways, I/O modules, sensors, most industrial computers | The manufacturer itself |
| Important, class I | Switches, routers, products with VPN, network management systems, operating systems | The manufacturer itself if harmonised standards are applied in full, otherwise a third party |
| Important, class II | Firewalls, intrusion detection systems | Always a third party |
| Critical | Including smartcards and smart meter gateways | Special certification |
Where a particular product ends up depends on its core functionality. A secure router with a firewall may therefore be assessed differently from a simple switch. Ask the manufacturer how they have classified the product.
What does IEC 62443 have to do with it?
IEC 62443 is the established series of standards for cybersecurity in industrial automation systems. Two parts are of particular interest to anyone buying components:
- IEC 62443-4-1 describes a secure development process at the manufacturer: how products are designed, tested and maintained.
- IEC 62443-4-2 sets technical security requirements for the component itself, in four security levels (SL 1–4).
IEC 62443 is not the same as the CRA, and the EU is developing its own harmonised standards for the Regulation. But the requirements overlap to a large extent. A manufacturer that is already certified to IEC 62443-4-1 and has products certified to 62443-4-2 is well on the way.
What should you ask your supplier?
- Classification: how have you classified the product under the CRA, and when will it be CE marked under the Regulation?
- Support period: how long will the product receive security updates, and how are they delivered?
- Vulnerabilities: how do we report a vulnerability to you, and how do you announce new ones (security advisories, PSIRT)?
- SBOM: is there a list of the software components in the product?
- IEC 62443: is the development process or the product certified to 62443-4-1 and 4-2?
- Earlier deliveries: will products we buy before December 2027 continue to receive updates?
If you build machines or installations
If you build a switch or industrial computer into a machine you sell in the EU, the machine does not automatically become a CRA product – it is the components that must comply with the Regulation. But you are responsible for the safety of the machine as a whole. The new Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027, requires among other things protection against corruption that could lead to hazardous situations. So choose components with a long support period and documented vulnerability handling, and plan how updates will be carried out at the end customer’s site.
If you sell software or a product with digital elements under your own name, you count as the manufacturer yourself.
Common mistakes
- Waiting until 2027. The reporting obligation already applies, and projects delivered after December 2027 should be planned with CRA-compliant components now.
- Confusing CE marking with cybersecurity. Today’s CE marking does not cover cybersecurity. It only will with the CRA.
- Forgetting the support period. A switch that will sit in an installation for 15 years needs updates for longer than an office switch. Compare support periods, not just prices.
- Leaving default settings. Even a CRA-compliant product must be configured correctly: change passwords, close unused ports and services and divide the network into zones.
Network products from SCN
Our manufacturers of switches, routers and industrial computers are preparing for the CRA. Moxa, for example, is certified to IEC 62443-4-1 and has products certified to IEC 62443-4-2. As a distributor, we check that products have the correct CE marking and documentation, and we pass on security information from the manufacturers to you. Ask us about the support period and CRA status of a particular product.
Examples from our range
MoxaEDS-4008 managed switchManaged switch in the EDS-4000 Series, certified to IEC 62443-4-2.View product →
MoxaEDR-G9010 secure gigabit routerRouter, firewall and switch in one, certified to IEC 62443-4-2 level SL2.View product →
MoxaTN-4900 secure M12 routerSecure router with M12 connectors for trains and vehicles, certified to IEC 62443-4-2 level SL2.View product →Erik Ahlqvist is Managing Director of SCN and has spent more than 20 years helping industrial companies choose the right electronics for demanding environments. He holds a BSc in Electronics from KTH Royal Institute of Technology, Stockholm.
LinkedIn profileFrequently asked questions
Does the CRA apply to products we have already installed?
No, the requirements apply to products placed on the market from 11 December 2027. Installed equipment does not need to be replaced. However, manufacturers must already report actively exploited vulnerabilities, including in older products.
Can we buy switches without CRA marking after December 2027?
Products placed on the market before that date may continue to be sold, for example from stock. Products placed on the market after that date must comply with the CRA.
Which CRA class does an industrial switch fall into?
Class I. Routers, modems and switches count as important products, which means stricter requirements for how the manufacturer demonstrates that the product meets the requirements. A router with firewall functionality may fall into class II.
Is it enough for the product to be certified to IEC 62443?
Not automatically. IEC 62443 covers many of the same requirements and is a strong sign that the manufacturer takes security seriously, but formally it is CE marking under the CRA that counts.
Does the CRA apply in the UK and Norway?
The CRA is an EU regulation and applies directly in EU member states. It is marked as EEA-relevant and is expected to become part of the EEA Agreement, but as of November 2026 it had not yet been incorporated into Norwegian law. The UK has its own rules. Anyone selling into the EU must comply with the CRA regardless.
This is general guidance, not legal advice. The full text of the Regulation is available on EUR-Lex: Regulation (EU) 2024/2847.
More guides on Network Products
All guides →Want to know the CRA status and support period of a particular product? Ask our engineers – you will get an answer within 24 hours.
Ask us