CRA Compliance Solution

Effective Date: Two-phase implementation

• Vulnerability-Disclosure Obligations, Sep. 11, 2026
• Full implement, Dec. 11, 2027

Scope: Products with digital elements, encompassing both hardware and software, that are connected to a network or device.

Penalties: Can reach up to €15 million or 2.5% of a company's global annual turnover, whichever is higher.

Effective Date: Aug. 1, 2025

Scope: Any wireless device capable of internet communication. Devices processing personal, traffic, or location data. Wireless devices handling monetary or virtual currency transfers.

Penalties: Non-compliant products will be blocked at import, preventing entry into the EU market, or forced recall.

Effective Date: Oct. 18, 2024

Scope: Large company in critical sectors like energy, transport, finance, health, water, digital infrastructure, public administration, and space. Mid-sized firms in sectors such as postal services, waste management, chemicals, food, manufacturing, digital providers, etc.

Penalties: Fines of up to €10 million or 2% of annual global turnover, whichever is higher.

Scope: Equipment manufacturers, system integrators, or service providers supplying gear to semiconductor fabs

Why It Matters:

1. Designed to prevent supply-chain attacks
2. Aligns with Global Standards (IEC 62443)
3. Becoming a procurement must-have

Scope: Focused on securing data and communication within power system operations in protocols used for monitoring, control, and automation of electrical grids

Why It Matters:
IEC 62351 is a sector-specific standard, providing highly detailed security for the communication protocols used exclusively in electric power systems. You could say IEC 62351 builds upon or specializes elements of the broader IEC 62443 principles for its domain.

Scope: Focuses on the cyber resilience of individual onboard systems and equipment within vessels. It sets minimum requirements for manufacturers and OEMs of computerized systems (both IT and OT) to ensure their hardware and software components have specific security capabilities throughout their lifecycle.

Why It Matters:
Mandatory for new ships contracted from Jul. 1, 2024, UR E27 is critical for enhancing maritime safety and operational integrity. Often referencing or drawing principles from IEC 62443 for its technical basis. By requiring secure-by-design principles for onboard systems, it helps prevent cyberattacks from impacting critical vessel functions like navigation or propulsion, thus safeguarding lives, property, and the environment from escalating cyber threats at sea.