An early device manufacturer will catch the worm when the EU’s cyber resilience regulation comes into force in September

From the reader. In September, the moment will come when some hardware and software manufacturers will have a clear competitive advantage in the European market. Those companies that have managed to manage their affairs in accordance with the EU’s cyber resistance regulation, win tenders and avoid hefty fines. Why does this happen?

Manufacturers are now adding a lot of artificial intelligence features to their products. Clocks, televisions, refrigerators or entire homes with the Äly prefix really interest consumers. Digitization and artificial intelligence are also mainstream in industry – not a few production plants run without an internet connection.

The EU’s cyber resilience act (Cyber ​​Resilience Act, CRA) requires that the security of artificial intelligence must be taken care of as well as other information security. In practice, the regulation applies to any product with an internet connection.

If the company does not take care of its products to the required condition now, the stores that have been massaged throughout the spring can fall apart in the last few meters. More and more companies and public sector customers are already including CRA requirements in their supplier contracts.

Harsh sanctions are looming

When the regulation enters into force immediately after the holidays on September 11, the first thing to do is the reporting obligation. From then on, manufacturers must report within 24 hours any vulnerabilities that attackers have managed to exploit.

In December, the rest of the CRA’s product requirements will come into force, and every digital product brought to the EU market must meet all the requirements of the regulation. At the same time, the EU’s Artificial Intelligence Regulation (AI Act) tightens the rules of the game for high-risk AI systems.

Companies that embed artificial intelligence in their products have to reconcile the requirements of both cyber security and obligations regarding the reliability and transparency of artificial intelligence.

Sanctions for insufficient information and actions are severe: at least 15 million euros or 2.5 percent of the company’s global turnover. Delayed reporting can lead to a fine of up to 10 million euros.

The fastest way to protect your cell phone

Finnish hardware and software manufacturers should therefore be alert. The fastest way to ensure your own safety is to map out what changes are required for compliance. Data security must be built into products already in the design phase. In addition, processes must be put in place to monitor vulnerabilities in real time and report them quickly.

There is support for preparation, and it is not about massive investments. For example, agent AI can speed up work by producing software bill of materials (SBOMs) and documentation, and by supporting threat modeling.

Finns are known to be good at following the rules – this fall, this virtue can rise to an unpredictable value.

Harri Saikkonen

director, software and embedded solutions, Etteplan