# EU Cyber Resilience Act (CRA) **URL:** https://forums.balena.io/c/eu-cyber-resiliance-act-cra/98.md [Latest](https://forums.balena.io/latest.md) · [Categories](https://forums.balena.io/categories.md) · [Tags](https://forums.balena.io/tags.md) --- ## [About the EU Cyber Resilience Act (CRA) category](https://forums.balena.io/t/about-the-eu-cyber-resilience-act-cra-category/374108)
**Author:** [@mpous](https://forums.balena.io/u/mpous)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 2:14pm UTC](https://forums.balena.io/t/about-the-eu-cyber-resilience-act-cra-category/374108 "2025-04-23T14:14:07Z")
This category is the central space dedicated to helping you navigate the EU Cyber Resilience Act (CRA) and other IoT security and compliance topics. The CRA is a new regulation designed to improve the cybersecurity of c… --- ## [Security vulnerability and incident reporting of devices managed by Balena](https://forums.balena.io/t/security-vulnerability-and-incident-reporting-of-devices-managed-by-balena/375685)
**Author:** [@seing.cheah](https://forums.balena.io/u/seing.cheah)\ **Replies:** 2\ **Last updated:** [April 1, 2026, 11:30am UTC](https://forums.balena.io/t/security-vulnerability-and-incident-reporting-of-devices-managed-by-balena/375685 "2026-04-01T11:30:13Z")
CRA requires that actively exploited vulnerabilities and critical incidents be reported to the Single Reporting Platform managed by ENISA. How are security events on Balena managed devices such as Raspberry PIs handled s… --- ## [Update on Our CRA Compliance and Technical Documentation](https://forums.balena.io/t/update-on-our-cra-compliance-and-technical-documentation/374880)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [October 3, 2025, 8:22am UTC](https://forums.balena.io/t/update-on-our-cra-compliance-and-technical-documentation/374880 "2025-10-03T08:22:14Z")
We wanted to share an update on our progress and our current position regarding the required Technical Documentation. Right now, our team is looking into the nuances of the legislation and the ongoing EU standardization… --- ## [Class I vs. Class II: How to Know Where Your Product Fits](https://forums.balena.io/t/class-i-vs-class-ii-how-to-know-where-your-product-fits/374163)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 3\ **Last updated:** [May 13, 2025, 3:01pm UTC](https://forums.balena.io/t/class-i-vs-class-ii-how-to-know-where-your-product-fits/374163 "2025-05-13T15:01:01Z")
The CRA introduces a two-tier system for “important” products with digital elements—Class I and Class II—as defined in Article 7 and detailed in Annex III of the regulation. Understanding the distinction is crucial beca… --- ## [How to contribute to the EU Cyber Resiliance Act (CRA) forums](https://forums.balena.io/t/how-to-contribute-to-the-eu-cyber-resiliance-act-cra-forums/374215)
**Author:** [@mpous](https://forums.balena.io/u/mpous)\ **Replies:** 0\ **Last updated:** [May 8, 2025, 10:11am UTC](https://forums.balena.io/t/how-to-contribute-to-the-eu-cyber-resiliance-act-cra-forums/374215 "2025-05-08T10:11:57Z")
First of all, we are incredibly lucky to have you all as part of our community. We are thrilled you are here to learn, share and help others build amazing things with edge devices, IoT and balena. To keep this a product… --- ## [🔍 What Is the EU Cyber Resilience Act and Who Needs to Comply?](https://forums.balena.io/t/what-is-the-eu-cyber-resilience-act-and-who-needs-to-comply/374186)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 5, 2025, 8:08am UTC](https://forums.balena.io/t/what-is-the-eu-cyber-resilience-act-and-who-needs-to-comply/374186 "2025-05-05T08:08:29Z")
If you make, sell, or update connected devices or software in the EU—you probably fall under the Cyber Resilience Act (CRA). The CRA is the EU’s new horizontal regulation setting mandatory cybersecurity requirements for… --- ## [Important dates to have in mind](https://forums.balena.io/t/important-dates-to-have-in-mind/374209)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 7, 2025, 10:30am UTC](https://forums.balena.io/t/important-dates-to-have-in-mind/374209 "2025-05-07T10:30:54Z")
Dates affecting you 11 December 2025 To help economic operators perform their product classification, the European Commission will adopt technical descriptions of the categories of products with digital elements. (Articl… --- ## [CRA vs. U.S. Cybersecurity Labeling](https://forums.balena.io/t/cra-vs-u-s-cybersecurity-labeling/374185)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 5, 2025, 8:03am UTC](https://forums.balena.io/t/cra-vs-u-s-cybersecurity-labeling/374185 "2025-05-05T08:03:41Z")
The EU’s Cyber Resilience Act (CRA) and the U.S.’s forthcoming Cybersecurity Labeling Program—anchored by the U.S. Cyber Trust Mark—are both pushing for better security in connected products. While the CRA is a mandatory… --- ## [CRA Requirements Against AI Act for High-Risk AI Products](https://forums.balena.io/t/cra-requirements-against-ai-act-for-high-risk-ai-products/374184)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 5, 2025, 7:54am UTC](https://forums.balena.io/t/cra-requirements-against-ai-act-for-high-risk-ai-products/374184 "2025-05-05T07:54:48Z")
Has anyone here already done a dual mapping of CRA vs AI Act requirements? Especially for edge AI or embedded systems that could qualify as high-risk AI? The two regulations actually align in some areas—and seem intenti… --- ## [What Is the Software Bill of Materials (SBOM) and Why Does CRA Need It?](https://forums.balena.io/t/what-is-the-software-bill-of-materials-sbom-and-why-does-cra-need-it/374168)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 9:58am UTC](https://forums.balena.io/t/what-is-the-software-bill-of-materials-sbom-and-why-does-cra-need-it/374168 "2025-05-02T09:58:53Z")
Under the EU Cyber Resilience Act (CRA), having a clear view of what’s inside your software is essential, and that’s exactly what an SBOM provides. What’s an SBOM? A Software Bill of Materials (SBOM), also called a sof… --- ## [Internal Control: How to Prepare a Solid Declaration of Conformity](https://forums.balena.io/t/internal-control-how-to-prepare-a-solid-declaration-of-conformity/374169)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 10:03am UTC](https://forums.balena.io/t/internal-control-how-to-prepare-a-solid-declaration-of-conformity/374169 "2025-05-02T10:03:11Z")
If you manufacture or distribute connected devices in the EU, and your product is subject to the Cyber Resilience Act (CRA), you may be able to use the internal control conformity route (Module A) to show compliance. Her… --- ## [Cyber Risk Assessment for an Edge Device](https://forums.balena.io/t/cyber-risk-assessment-for-an-edge-device/374170)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 10:08am UTC](https://forums.balena.io/t/cyber-risk-assessment-for-an-edge-device/374170 "2025-05-02T10:08:13Z")
Under Article 13(2) of the EU Cyber Resilience Act (CRA), manufacturers must conduct a cybersecurity risk assessment for each product with digital elements, but when it comes to edge devices, there are unique threats and… --- ## [Substantial Modification: Examples and Grey Areas](https://forums.balena.io/t/substantial-modification-examples-and-grey-areas/374172)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 10:42am UTC](https://forums.balena.io/t/substantial-modification-examples-and-grey-areas/374172 "2025-05-02T10:42:29Z")
Let’s talk about substantial modifications—one of the trickier concepts in the CRA. According to Article 3(30) of the Cyber Resilience Act, a “substantial modification” is a change to a product with digital elements aft… --- ## [FOSS Stewardship: What You’re Responsible for Under CRA](https://forums.balena.io/t/foss-stewardship-what-you-re-responsible-for-under-cra/374167)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 9:55am UTC](https://forums.balena.io/t/foss-stewardship-what-you-re-responsible-for-under-cra/374167 "2025-05-02T09:55:42Z")
If your product includes open source components, you’re not off the hook under the CRA. Even when no single vendor “owns” the code, the manufacturer of the final product is responsible for securing it. Let’s break down w… --- ## [What's the Process to Report and Fix Vulnerabilities](https://forums.balena.io/t/whats-the-process-to-report-and-fix-vulnerabilities/374166)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 9:48am UTC](https://forums.balena.io/t/whats-the-process-to-report-and-fix-vulnerabilities/374166 "2025-05-02T09:48:15Z")
Under the CRA, vulnerability handling is a formal obligation for manufacturers. It’s detailed across several articles and Annex I, and includes both proactive management and regulated reporting steps. What the CRA Requ… --- ## [Secure Update Systems for OTA (Over-the-Air) Deployment](https://forums.balena.io/t/secure-update-systems-for-ota-over-the-air-deployment/374165)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 9:37am UTC](https://forums.balena.io/t/secure-update-systems-for-ota-over-the-air-deployment/374165 "2025-05-02T09:37:51Z")
When you ship connected products, secure OTA updates are not optional: they’re a legal requirement under the CRA. But what exactly does the regulation say, and how should you implement it? What the CRA Requires The CRA… --- ## [Does my Product Need Full Disk Encryption Under the CRA?](https://forums.balena.io/t/does-my-product-need-full-disk-encryption-under-the-cra/374164)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 9:35am UTC](https://forums.balena.io/t/does-my-product-need-full-disk-encryption-under-the-cra/374164 "2025-05-02T09:35:44Z")
Let’s get this straight: the CRA does not explicitly require full disk encryption. But that doesn’t mean you can ignore data protection entirely. What the CRA Actually Says The CRA, in Annex I, Part I, point (1), requi… --- ## [Is my product covered by CRA?](https://forums.balena.io/t/is-my-product-covered-by-cra/374162)
**Author:** [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 8:46am UTC](https://forums.balena.io/t/is-my-product-covered-by-cra/374162 "2025-05-02T08:46:47Z")
The CRA applies to almost everything with a chip or a bit of code that connects to something. It targets “products with digital elements” —that includes both hardware and software (including SaaS) that can connect, even …