The potential risk from cyberattacks increases as the number of connected devices, machines, devices, and
sensors keeps growing. It is predicted that in 2025, there will be 75 billion connected devices worldwide. With
the number of devices and the size of the attack surface increasing, in 2025, there will be an estimated 10.5
trillion dollars in damages from cybercrime1
.
Security is a critical element in the development of products against intentional or unintentional threats. These
threats include unauthorized access, installation of malware, ransomware, spyware, or loss of data with
the corresponding privacy breach. They can have impact of a secondary nature, such as personal injury,
equipment damage, supply chain downtime, environmental impact, loss of production, or violation of regulatory
requirements.
To improve the cyber resilience in the European Union, in 2024, the European Parliament adopted the Cyber
Resilience Act2
(CRA) to ensure the cybersecurity of products and software with digital elements. It covers
anything from hard disks and chips to firewalls and robots. The CRA describes the requirements (technical and
process) and obligations of manufacturers, importers, distributors, and third parties that supply their products to
the European market.
The CRA was published in the European Official Journal as Regulation (EU) 2024/2847. It will be fully enforced
from December 11, 2027. From that date, all products with digital elements introduced in the European
market must comply with the regulation. Products operating on markets and applications with similar security
requirements are not required to comply with the CRA (for example, certain vehicle types, medical, aeronautic
equipment and planes, as well as maritime equipment).
For NXP, the impact is twofold. Firstly, NXP products are digital elements that must comply with CRA. Secondly,
NXP products are integrated into OEM devices and machines that must comply with CRA.
Manufacturers of products with digital elements must comply with the essential requirements of the CRA. This
requires manufacturers to "own" the product’s cybersecurity risk, mitigate such risk, and communicate it to
the users. Only when compliant, a manufacturer is allowed to affix the CE mark to its products. This mark is
mandatory for access to the EU market.
Penalties for noncompliance with the essential requirements of the CRA amount to up to 15 million euros, or 2.5
% of the annual turnover, whichever is higher. Those surveillance-authorized are empowered to issue product
recalls or, in extreme circumstances, withdrawal from the European market in cases of nonconformance.
Therefore, the consequences of the CRA have a particularly large impact.