Cyber Resilience Act and Firmware: Essential Compliance Guide
Navigate EU Regulation 2024/2847 requirements for embedded systems, microcontrollers, board support packages, and C/C++ firmware development.
The Cyber Resilience Act (CRA) mandates that all embedded software in connected products sold within the EU must be secure by design, transparently documented, and actively maintained. For firmware developers, this means low-level code, bootloaders, and RTOS components now require a Software Bill of Materials (SBOM), robust update mechanisms, and structured ENISA reporting workflows.
Understanding EU Regulation 2024/2847 for Embedded Systems
The Cyber Resilience Act entered into force on 10 December 2024, establishing unified cybersecurity standards for all hardware and software products with digital components.
- Vulnerability reporting obligations commence on 11 September 2026, mandating rapid disclosure to ENISA.
- Full product compliance and technical documentation requirements take effect on 11 December 2027, with non-compliance penalties reaching EUR 15M or 2.5% of global turnover.
Core Legal Mandates for Firmware Developers
Embedded code is the bedrock of hardware security. Compliance requires shifting security practices left into microcontrollers and low-level source repositories.
CycloneDX SBOM Generation
Generate structured Software Bills of Materials for microcontrollers, driver libraries, and RTOS stacks to ensure supply chain transparency.
ENISA Incident Workflows
Implement standardized procedures for 24-hour early warnings, 72-hour notifications, and 14-day final incident reports.
Security by Design Defaults
Enforce secure-by-default configurations, such as disabling JTAG/SWD interfaces in production and implementing verified secure boot sequences.
Annex VII Technical Documentation
Maintain comprehensive technical files detailing hardware-software risk assessments and lifecycle update policies.
Applying the CRA to Embedded Engineering Workflows
Firmware engineering involves complex hardware interactions and extended deployment cycles. Adapting your C, C++, and Rust codebases to the CRA requires automated tracking of embedded dependencies and security posture.
- Cataloging bare-metal libraries and third-party C/C++ component dependencies.
- Ensuring firmware updates are cryptographically signed and deliverable over-the-air (OTA).
- Generating machine-readable CycloneDX SBOMs for all hardware release packages.
- Documenting security mitigations across default, Annex III, and Annex IV product classes.
Product Classification Under the Cyber Resilience Act
Products are categorized by cybersecurity risk: default class, important products (Annex III, classes I & II), and critical products (Annex IV). Conformity assessment routes depend on your hardware's specific risk profile.
Essential Requirements for Firmware Security
Hardware vendors must ensure that embedded software stored on flash memory or ROM is free from known exploitable vulnerabilities upon release.
- Provide free security patches throughout the expected product lifecycle without compromising hardware performance.
- Enforce secure key storage and protected hardware root-of-trust mechanisms.
Mandatory Vulnerability Reporting Deadlines
From 11 September 2026, any actively exploited vulnerability in your firmware requires an early warning submission to ENISA and national CSIRTs within 24 hours.
Audit Your Firmware Codebase for CRA Readiness
Connect your GitHub repository to analyze firmware dependencies, calculate your CRA compliance score, and generate mandatory documentation.
How to Prepare Embedded Software for the CRA
- 1
1. Scan Firmware Repositories
Connect your source control to map bare-metal C/C++, Rust, or RTOS dependencies.
- 2
2. Generate CycloneDX SBOMs
Produce standardized Software Bills of Materials for every hardware release target.
- 3
3. Monitor Vulnerabilities
Receive automated alerts for newly reported security vulnerabilities affecting your embedded components.
- 4
4. Generate Pre-filled Compliance Docs
Create draft Annex VII technical documentation, SECURITY.md policies, and EU conformity statements.
How CRAcheck Supports Firmware Engineering Teams
CRAcheck is a self-assessment platform designed to help device manufacturers and embedded engineers streamline regulatory preparation.
- Analyzes repositories across 9 ecosystems including C/C++, Rust, and raw CycloneDX files.
- Provides a clear compliance score out of 100 to identify gaps in vulnerability management and documentation.
- Automates the creation of draft Annex VII documentation, SECURITY.md files, and ENISA notification templates.
Frequently Asked Questions
Does the Cyber Resilience Act cover open-source firmware?+
Open-source firmware components integrated into commercial hardware fall under CRA obligations for the manufacturer placing the finished product on the EU market.
What are the timeline milestones for firmware developers?+
Vulnerability reporting rules apply from 11 September 2026. Full technical compliance, SBOM delivery, and Annex VII documentation are mandatory by 11 December 2027.
Is CRAcheck an official certification authority?+
No. CRAcheck is a self-assessment tool designed to automate SBOM generation and documentation drafting; it is not an official conformity assessment body.
What penalties exist for failing to comply with CRA rules?+
Violations of cybersecurity obligations or reporting duties can result in administrative fines of up to EUR 15 million or 2.5% of total annual worldwide turnover.
Get Your Firmware CRA-Ready Before the Deadlines
Connect your repository to calculate your compliance score and generate essential firmware SBOMs.
Same topic — Par type de produit
New to the Cyber Resilience Act? Start with the complete guide.
The CRA guideFrom the blog
Check your CRA compliance in 1 minute
Free, no sign-up. Scan your repo and get your compliance score + pre-filled documents.