In comparison to the other economic operators, the manufacturer is subject to the most comprehensive obligations of the proposed CRA (CRA-E). This is probably because the manufacturer significantly controls the development of the product with digital elements, determines its characteristics and can thus influence the inherent cybersecurity risks. The specific obligations for manufacturers are set out in Art. 10 and 11 of the proposed CRA.

As a main obligation Art. 10 (1) CRA-E stipulates that products with digital elements have to be designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I in order to be placed on the market.

Therefore, Section 1 of Annex I stipulates, inter alia, that products with digital elements shall be delivered with a secure by default configuration, including the possibility to reset the product to its original state, be designed to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques as well as ensure that vulnerabilities can be addressed through security updates.

The exact requirements in Section 1 (3) of Annex I that shall be fulfilled depend on the result of the cybersecurity risk assessment that is stipulated in Art. 10 (2) CRA-E. Thus, this assessment is the starting point for the security standards to be met and the result needs to be considered over the entire life cycle of a product with digital elements.

However, the manufacturer must not only ensure a certain nature of the product with digital elements, but also implement vulnerability handling processes, which are specified in Annex I Section 2 CRA-E. This includes a regular review of the product security and a prompt remediation of vulnerabilities, for example, by providing security updates.

All data and details on how the manufacturer ensures that the products and vulnerability handling processes comply with the requirements in Annex I must be recorded in a technical documentation in accordance with Art. 10 (7) and Art. 23 (1) CRA-E. This documentation must include, for example, a general product description, an assessment of the cyber security risks and a description of solutions to ensure compliance. The technical documentation must be retained for a period of 10 years.

In order to enable manufacturers to prove that both products with digital elements and processes meet the requirements of the CRA-E, they must carry out a so-called conformity assessment procedure in accordance with Art. 10 (7) and Art. 24 (1) CRA-E. Depending on the criticality of the product, a certain type of procedure must be completed. When the assessment is concluded and the product is deemed to be CRA compliant, the manufacturer must issue an EU declaration of conformity, keep it for a period of 10 years and attach it to the product. By issuing this declaration, he assumes responsibility for the permanent conformity of the product with digital elements and must also ensure this in the event of a substantial modification within the meaning of recital 23 sentence 1 of the CRA-E to such a product.

Furthermore, according to Art. 10 (6) and (12) CRA-E, the manufacturer is obligated to deal with vulnerabilities or to fulfill corrective measures, whereby according to the current draft, a time limit of a maximum of five years from placing the product on the market applies.

The information obligations include the provision of information and instructions when placing the product on the market in accordance with Art. 10 (10) and Annex II CRA-E. In particular, the manufacturer must provide his contact details and enclose information on the scope of functions and safety features as well as detailed instructions on how to use the product. Furthermore, users must be informed about all circumstances that may lead to significant cybersecurity incidents in connection with a use of the product. In addition, a CE marking must be affixed in accordance with Art. 10 (7) CRA-E.

The notification obligations include, among others, the provision of documentation demonstrating conformity of the product with digital elements and of the processes put in place to the market surveillance authority upon request according to Art. 10 (13) as well as a notification of the cease of operations according to Art. 10 (14) CRA-E. Furthermore, pursuant to Art. 11 (1) and (4) of this regulation, the ENISA and the users of the product with digital elements must be informed about cybersecurity incidents.

Practical recommendations:

Due to the comprehensive requirements set out in the CRA-E, products will have to feature numerous safety functions in the future. In this respect, manufacturers will have to expend more effort in the planning and design of products with digital elements. At the same time, the liability risk increases if the manufacturer's comprehensive obligations are not properly implemented. For this reason, we recommend that companies falling under the definition of a manufacturer deal with the new regulations of the CRA-E at an early stage and adapt as well as implement the corresponding processes in their production operations in good time.

In our CRA-Update series, we regularly present information on the proposed Cyber Resilience Act and keep you informed about changes in the ongoing legislative process. In each of our articles, we give you a brief overview of a specific topic, presenting the most important aspects and practical implications.