Scope of EU Cyber Resilience Act - Page 1
Forum section: electronics / general

author: SethGPI
author_rank: Newbie
timestamp: September 25, 2025, 03:57:45 pm
content: I know there's an old"heads-up" thread from a few years agoon the topic of theEU's CRA.Is anyone here any more of an expert on this legislation now? We do some embedded design without internet/cloud connectivity. However, in some instances, our products are used as inputs to industrial equipment/PLCs. These interfaces being analog 4-20mA (no HART) and variable frequency "digital" signals which are purely open-collector pulses for volumetric counting from a fluid flow meter. All communication is one-way, from our product into a PLC or equivalent machine. The products do have microcontrollers in them for calibration and linearization as well as various customer settings.In recent discussions with a firmware house for future products, they mentioned that even our 4-20mA products will have to comply with the CRA to our surprise. Granted, this came from a director-level conversation. Looking in the legislation as an engineer and not a lawyer, there are some definitions of terms which make me think that our products would not need to be compliant, but there are also some terms and clauses that are vague enough that it could. For example, the PLCcouldbe internet connected, and our products would be an input to this internet-connected device.Of course for actual legal analysis we would need some legal council, but does anyone here have any familiarity with this legislation and its application in the embedded space?

author: tszaboo
author_rank: Super Contributor
timestamp: September 25, 2025, 04:12:39 pm
content: As far as I know, for now, it's covered under the radio equipment directive, or RED. You can download the legislation from EUs website, and it will have an annex, listing all the applicable "harmonized standards". The legislation will tell you how you can get compliance with it.You need to figure it out which standards are applicable to your products.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 25, 2025, 04:27:30 pm
content: As I read it, it applies to anything potentially connected to a larger "network" - not necessarily directly the Internet.That means pretty much anything with a LAN or WLAN connection, even if it never directly connects outside a LAN. I'll have to read it entirely though to figure out all the details. It's 81 freaking pages.I don't much like this pile of regulations over regulations over regulations, but I think this article is interesting:Quote

author: tszaboo
author_rank: Super Contributor
timestamp: September 25, 2025, 04:43:54 pm
content: Quote from: SiliconWizard on September 25, 2025, 04:27:30 pmThese regulations happen for a reason. The way I see it, it never happens proactively, it's always seem reactive. So some psychopath company decides to release products with built in default passwords, stealing data, having no security whatsoever, or provides 5 minutes of security updates to a phone that you are supposed to use for years.It's consumer protection. And it usually makes sense. Otherwise we would have a complete wild west corpocracy, that always end up in some dystopia. Don't blame the EU, blame the company that made this nessesary.