EU CRA – Cyber Resilience Act
In this blog series, we want to keep you up to date on the implementation of the Cyber Resilience Act (CRA) for IACBOX.
Overview
The CRA is an EU-wide regulation (EU 2024/2847) that applies to all products with digital elements. The only exceptions are products that are already subject to other/stricter regulations in areas such as medical devices, automotive, etc.
Key CRA Points:
– As an EU regulation, it enters into force directly and does not require national transposition (unlike NIS2).
– The product must be developed through a secure development lifecycle and maintained accordingly.
– Security updates must be provided promptly and free of charge for the expected product lifetime of at least 5 years.
– Updates must remain available for 10 years.
– Pure SaaS products are also exempt, provided that no other on-premises products depend on them. This means that cloud services such as the IACBOX licensing and update server also fall within the scope of the CRA.
Timeline
– The CRA already entered into force in December 2024.
– However, there is a transition period until December 11, 2027. From that date forward, affected products may only be placed on the EU market if they are CRA-compliant and bear the CE marking.
– Legacy products already in operation are exempt from the essential requirements and the CE marking obligation; however, reporting obligations still apply.
– The initial obligations take effect as early as September 11, 2026. Actively exploited vulnerabilities or severe security incidents must be reported to ENISA, which will automatically notify the competent national CSIRT—in Austria, CERT.at.
Categorization
The CRA divides products into several categories with differing requirements.
– Standard – Products with digital elements: the majority of offered products with lower cybersecurity risk – self-assessment of CRA compliance
– Important products
– Subgroup Class I: Self-assessment of CRA compliance when applying a harmonized standard (these are currently (Aug 2026) still pending!) or a notified body must assess CRA conformity
– Subgroup Class II: Hypervisors, intrusion detection/prevention systems, firewalls, products whose primary functions are designed for security. A notified body must assess CRA conformity
– Critical products: Hardware security, smart cards, secure elements, etc.
As a networking product, IACBOX falls into the category of “Important products – Class I”, and we are aiming for a self-assessment based on a harmonized standard, provided one is available in time.
IACBOX Roadmap
– The current versions v24 and v26 are still based on our proven proprietary Linux platform. After December 2027, these versions will only receive security updates and bug fixes that do not represent substantial modifications.
– The first CRA-compliant version will be v27, scheduled for late 2027 and built on a new Linux platform to meet the stringent requirements more efficiently.
Contact
Stay secure and up to date with IACBOX Software Maintenance! Please contact us if you require further information.