The Cyber Resilience Act (CRA) has reshaped European IoT security, which until now relied on recommendations and best practices, into a legal obligation to notify. Under this law, security becomes a legal requirement for selling a connected product in Europe, obligating manufacturers to disclose vulnerabilities that are actively exploited and serious incidents affecting the security of products with digital elements.
However, many organizations do not understand that these obligations extend beyond manufacturers. Because of the complex IoT landscape, ensuring true compliance requires that responsibility go beyond the manufacturers themselves, who, ultimately, cannot guarantee the security of an implementation architecture they do not design, do not manage, or even know exists.
Xabier Olea, Technical Director at Wireless Logic, explains why organizations must go beyond product-level compliance when considering the cybersecurity and reporting obligations in real IoT deployments:
“Although the CRA correctly holds manufacturers responsible for the cybersecurity of products with digital elements, its product-centric allocation does not currently reflect how cyber risk is generated in real IoT deployments. Manufacturers can protect a device against its intended and reasonably foreseeable use, but they cannot guarantee a deployment architecture that they do not design or operate,” says Xabier Olea. For industries like IoT, the entity that assembles devices, connectivity, cloud platforms, applications, and operational processes in a service can, in fact, have substantially greater control and visibility over the resulting systemic cyber risk than equipment manufacturers.
“Therefore, the CRA should not be considered a global IoT cybersecurity regulation. Instead, it acts as a starting point to ensure that connected products entering the EU market are secure by design and supported throughout their lifecycle, adds the technical director. “Long-term genuine resilience requires organizations to understand this regulation as part of a broader cybersecurity model that also addresses frameworks such as the NIS2 and IEC 62443.”
As the reporting requirements come into effect, organizations must go beyond basic product compliance and ask how they would actually detect a breach across the entire system. As Xabier Olea notes, “true resilience requires continuous visibility across connected assets, strict credential control, network segmentation, and clear multi-vendor incident response plans.”
