Executive Compliance Guide: Cyber Resilience Act | Navigating EU Law

Executive Compliance Guide: Cyber Resilience Act

Navigating EU Law

July 02, 2026

Global
Global
Global
The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for connected hardware and software products sold in the EU. It requires manufacturers, importers, and distributors to embed security throughout the product lifecycle, manage vulnerabilities, report serious incidents, and demonstrate compliance through CE marking.

Since its entry into force on 10 December 2024, the CRA has been reinforced by additional EU actions, including: 

  • Technical standards to help businesses implement and demonstrate compliance with the CRA's cybersecurity requirements
  • Identification of higher-risk digital products that will be subject to stricter conformity assessment and compliance requirements
  • The Digital Omnibus proposal, published in November 2025, to streamline incident reporting under the CRA, NIS2, and GDPR
  • Guidance clarifying the CRA’s application to open-source software, remote data processing, support periods, and overlap with other EU rules

The materials on the Eversheds Sutherland website are for general information purposes only and do not constitute legal advice. While reasonable care is taken to ensure accuracy, the materials may not reflect the most current legal developments. Eversheds Sutherland disclaims liability for actions taken based on the materials. Always consult a qualified lawyer for specific legal matters. To view the full disclaimer, see our Terms and Conditions or Disclaimer section in the footer. Eversheds Sutherland is a provider of legal and other services operating through various separate and distinct legal entities. For further information about these entities and Eversheds Sutherlands' structure please see the Legal Notice page of this website.

Guides and Reports

Navigating EU Law

Services

Industries

Business Topics

Key contacts

olafvanhaperen@eversheds-sutherland.com

Olaf van Haperen

Partner

Rotterdam, Netherlands

carolinelyannaz@eversheds-sutherland.com

Caroline Lyannaz

Partner

Paris, France

nilsmueller@eversheds-sutherland.com

Nils Müller

Partner

Munich, Germany | Hamburg, Germany

robbertsantifort@eversheds-sutherland.com

Robbert Santifort

Partner

Rotterdam, Netherlands

maartenstassen@eversheds-sutherland.com

Maarten Stassen

Partner

Brussels, Belgium

JoannaKulewska@eversheds-sutherland.com

Joanna Kulewska

Knowledge Lawyer

Brussels, Belgium

Latest Insights

Latest News

Latest Events

ma-2026-report-intro

guides and reports

October 07, 2026

Technology, AI and the changing legal landscape of M&A

ma-report-2026-part1

guides and reports

October 07, 2026

How AI is democratizing M&A for buyers and investors

skyscrapers

legal updates

October 07, 2026

EU: Proposed KIDS Act Targets Online Child Safety

ma-report-2026-pandc

guides and reports

October 07, 2026

© Eversheds Sutherland 2026. All rights reserved. Eversheds Sutherland is a provider of legal and other services operating through various separate and distinct legal entities. For further information about these entities and Eversheds Sutherlands' structure please see the Legal Notice page of this website.

Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed or affiliated firms and the members of Eversheds Sutherland (Europe) Limited and Eversheds Sutherland (Africa) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global entity. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client. For further information about these Eversheds Sutherland Entities and Eversheds Sutherlands’ structure please see the Legal Notices page of this website. For information on Konexo please also see the Legal Notices page of this website.