The countdown has begun: in less than two years, every digital product sold in the EU must comply with the new Cyber Resilience Act (CRA). With penalties of up to €15 million or 2.5% of global annual turnover, compliance is essential for continued access to the European market.

At KEO, we regard the CRA not as an obstacle but as an opportunity to strengthen product quality and customer trust. We are preparing for external certification within 2026, even though our products are not classified as “critical.” This proactive approach gives our customers early certainty in a highly regulated and rapidly evolving landscape.

Who Is Affected?

The CRA’s scope is broader than many realise. You’re affected if you manufacture or sell:

  • IoT devices (smart home products, wearables, connected sensors)

  • Software and applications (standalone or embedded)

  • Embedded systems (industrial control, automotive software)

  • Hardware with software components

Turning Compliance Into Competitive Advantage

Key takeaway: CRA readiness is becoming a deciding factor for customers, and KEO positions itself ahead of the curve.

At KEO, we view the CRA as a strategic opportunity rather than a regulatory burden. We are voluntarily preparing for external certification by 2026, even though our products are not classified as “critical.” This gives our customers additional confidence at a time when cybersecurity requirements are increasing across all industries.

  • Customer Trust: CRA-aligned products are becoming an important purchasing criterion, especially in professional and industrial environments.
  • Legal Certainty: Proactive compliance reduces the risk of market restrictions and avoids last‑minute implementation pressure.
  • Market Advantage: Companies that move early gain a clear differentiation while competitors are still adapting.
  • Quality Proof: External certification provides independent validation of our security processes and product resilience.

The Five Critical Challenges

1. Five-Year Support Obligation

Security updates are required throughout the entire product lifecycle, including discontinued products. This demands long-term resource planning.

KEO today:
We maintain our products to consistently high standards and plan for long-term support.

2. 24-Hour Reporting Requirement

Actively exploited vulnerabilities must be reported within 24 hours, requiring robust monitoring and incident response processes.

KEO today:
We communicate openly and resolve security incidents promptly through established processes that already align with CRA expectations.

4. Software Bill of Materials (SBOM)

Machine-readable documentation of all software components is mandatory, requiring automated SBOM generation processes.

KEO today:
Our software products have included an SBOM since 2024, giving customers complete transparency over software composition.

5. Secure by Default Configuration

Products must ship with secure default settings. Security must be built-in from the first power-on.

KEO today:
Our EEBUS‑based products already follow strict security requirements, ensuring only trusted devices can connect.

Your Implementation Roadmap

Start Immediately:

  • Conduct portfolio analysis and risk assessment
  • Establish a dedicated CRA team
  • Perform comprehensive gap analysis

Q1 2026:

  • Implement Security by Design principles
  • Build vulnerability management procedures
  • Establish SBOM processes

Q2/Q3 2026:

  • Prepare technical documentation
  • Plan conformity assessment
  • Test incident response procedures

Q4 2026 – Q3 2027:

  • Implement a compliance management system
  • Establish continuous improvement processes

KEO’s CRA Whitepaper

We have consolidated our analysis and preparation experience into a comprehensive whitepaper, including:

  • A clear breakdown of all CRA requirements
  • Practical implementation strategies
  • A structured roadmap toward compliance
  • Insights gained from KEO’s own preparation

Companies that act early will gain a significant competitive advantage as the CRA enforcement date approaches.


Download Whitepaper

Download your personal copy of the whitepaper on the Cyber Resilience Act now. You will receive a download link via e-mail.
 *
 
 
*
*Required Fields
I would like to receive a download link for the whitepaper and hereby consent to receive electronic messages from KEO. For that purpose, I agree to the Privacy Policy.