Connected Technology Podcast Talks Episode 21 - The key requirements of the EU Cyber Resilience Act (CRA)

What does the EU Cyber Resilience Act (CRA) mean for manufacturers of connected products? In this episode of the Connected Technology Podcast Talks series, Element experts Alex Toohie and Mustanir Ali, Head of Cyber Product Assurance, explore the legislation's requirements, timelines, and practical compliance challenges.  

Why listen to this podcast?  

• Understand the key requirements of the EU Cyber Resilience Act (CRA) and how they affect manufacturers of products with digital elements. 

• Learn how the CRA differs from existing regulations such as the UK PSTI and the EU Radio Equipment Directive (RED) cybersecurity requirements. 

• Discover why risk assessment sits at the heart of CRA compliance and how it influences product design and security decisions. 

• Gain clarity on upcoming vulnerability and incident reporting obligations, including what must be reported and when. 

• Understand how to manage cybersecurity risks throughout a product's lifecycle, from development and market placement through to software updates and ongoing support. 

• Learn what manufacturers should be doing today to prepare for the CRA's implementation deadlines and evolving standards landscape. 

 

Key topics covered in this podcast:  

• How did current cybersecurity legislation evolve from the growth of connected and IoT devices? 

• What is the EU Cyber Resilience Act (CRA) and which products fall within its scope? 

• Why is a risk-based approach central to CRA compliance? 

• What cybersecurity obligations apply throughout the product lifecycle? 

• What are the new reporting obligations for actively exploited vulnerabilities and severe incidents? 

• Which CRA standards are being developed, and how will they support compliance? 
  
  

Listen to the podcast below.