Prague, November 2026. The EU Cyber Resilience Act (CRA) is already partly in force, and its main obligations will apply from December 2027. Several results planned in Moore4Power address obligations that the CRA creates. This article sets out the dates, the obligations and how we expect the project to help.

The dates

The CRA entered into force on 10 December 2024. According to the European Commission, reporting obligations apply from 11 September 2026, and the main obligations apply from 11 December 2027. Reporting is therefore already a legal duty, while the design and conformity requirements are still ahead.

What manufacturers must do

The Commission describes the CRA as a rulebook for connectable hardware and software. Manufacturers must meet cybersecurity requirements for planning, design, development and maintenance, and they must handle vulnerabilities throughout the lifecycle of a product, including by providing security updates.

Since 11 September 2026, manufacturers must also report actively exploited vulnerabilities and severe incidents. As cyberresilienceact.eu explains, the reporting runs in four steps:

  • Early warning: within 24 hours of becoming aware of the event.
  • Notification: within 72 hours, with the nature of the vulnerability or incident, an initial assessment and the measures taken or available to users.
  • Final report for a vulnerability: 14 days after a corrective or mitigating measure becomes available.
  • Final report for a severe incident: within one month of the notification.

Reports go to ENISA and to the CSIRT designated as coordinator, through the Single Reporting Platform. For manufacturers and essential requirements, fines can reach up to EUR 15 million or 2.5 percent of total worldwide annual turnover, whichever is higher.

What this means in practice

Consider a connected power module with a vulnerability that is being exploited. The 24-hour early warning starts when the manufacturer becomes aware. To close the case, the manufacturer then has to deliver a fix to the devices in the field. The update path therefore needs two properties: it must work quickly, and it must refuse updates from anyone who is not authorised. A fast update channel that anyone can abuse would replace one vulnerability with another.

This is where the project work connects to the CRA:

  • Authentication of updates and service access: i46 will develop a method for technician access and OTA authorisation, with an on-site option for devices that are offline. We describe the approach in our article on secure updates for connected power electronics.
  • Multi-party approval: i46 will aim to deliver a software interface that executes an update only after at least N out of M authorised people have approved it, which produces a clear record of who authorised what.
  • Automated security assessment: AIT will work on a security-by-design framework that supports compliance with the CRA through automated and continuous security assessments.

Which power electronics are in scope?

The Commission refers to connectable hardware and software. Whether a given product is in scope depends on its data connections and its intended use, so each manufacturer should assess this product by product. This article is not legal advice.

What we will test

Our hypothesis is that authenticated updates, together with automated security assessment, reduce the effort a manufacturer needs to produce evidence for the CRA. We will test it with partners by comparing the steps a manufacturer needs with and without the project's methods, and we will report the results.

The project has been accepted for funding within the Chips Joint Undertaking (CHIPS JU), a public-private partnership in collaboration with the Horizon Europe (HORIZON Framework Programme) and National Authorities under grant agreement number 101252572. Co-funded by European Union.

Disclaimer: the views and opinions expressed in this article are those of the author only. They do not necessarily reflect those of the European Commission or of the other Moore4Power partners, and neither can be held responsible for them.