Introduction
The EU Cyber Resilience Act (CRA) is now in force, imposing mandatory cybersecurity requirements on all products with digital elements (PDE) placed on the EU market. For automotive electronics exporters, the CRA has become another compliance threshold that must be crossed after UN R155.
1. What is the CRA and what does it cover?
The CRA is the EU regulation on the cyber resilience of products with digital elements, covering both hardware and software. Any product with a direct or indirect data connection — 4G, Bluetooth, Wi-Fi, Ethernet, and so on — may qualify as a PDE, requiring CRA compliance and CE marking.
2. How the CRA relates to R155 and ISO 21434
| Dimension | UN R155 / ISO 21434 | EU CRA |
|---|---|---|
| Nature | Vehicle type approval regulation / engineering standard | Product market regulation (CE/DoC) |
| Scope | Dedicated systems covered by type approval | Independently traded product SKUs |
| Boundary | Vehicle-side security | Aftermarket parts, retrofit devices, generic spare parts |
3. Core CRA requirements
- Security by design: security must be considered from the design and development stage.
- Vulnerability management: establish mechanisms for reporting and handling vulnerabilities.
- SBOM requirement: provide a machine-readable software bill of materials (CycloneDX/SPDX).
- Reporting obligations: Article 14 deadlines (early warning within 24 hours, vulnerability notification within 72 hours, final report within 14 days / 1 month).
4. How automotive electronics companies should respond
- Start with a CRA applicability assessment: determine whether the product is a standalone PDE.
- Gap analysis: review existing documentation against CRA Annex I requirements.
- Complete the SBOM, extend your TARA, and establish incident response processes.
- Prepare the technical documentation file and engage a conformity assessment body.
Conclusion
The CRA is not optional — it is a mandatory requirement for exporting to the EU. The earlier you prepare, the stronger your position in overseas markets.
Need Compliance Support?
Not sure whether your product falls under the CRA? QinGuard offers CRA applicability assessment and compliance gap analysis to clarify your export compliance pathway.