Cyber Resilience Act: Is Your Product Ready for the December 2027 Deadline?

The countdown to the EU Cyber Resilience Act is on. If your products integrate embedded systems, the new cybersecurity requirements could directly impact your business. Discover what is changing, why you should act now, and how Engicam and ATENYS can help you prepare.

 

The Cyber Resilience Act: A Deadline You Cannot Ignore

The European Union's Cyber Resilience Act (CRA) is introducing a new cybersecurity framework for products with digital elements. From industrial machinery and automation controllers to connected devices, intelligent gateways and IoT solutions, a wide range of products sold in the European Union will need to meet more stringent cybersecurity requirements.

The crucial deadline is December 11, 2027.

From this date, the main CRA requirements will become applicable, requiring manufacturers to demonstrate that their products are designed with cybersecurity in mind and that vulnerabilities can be effectively managed throughout the product lifecycle.

However, the first important obligations are already in force.

Since September 11, 2026, manufacturers have been required to report actively exploited vulnerabilities and severe security incidents affecting their products, including products already available on the EU market.

This means that cybersecurity compliance is no longer something to consider for future generations of products. It is a challenge that businesses need to address today.

 

Does the CRA Apply to Your Products?

If your company develops or markets products that incorporate embedded computing platforms, embedded Linux systems or connected electronic components, the CRA may directly affect you.

Consider some typical applications:

• Industrial automation: machine controllers, industrial PCs, HMIs and production equipment
• Industrial IoT: connected sensors, gateways, monitoring devices and remote control systems
• Energy and infrastructure: smart metering, energy management and intelligent control devices
• Transportation: connected equipment, communication systems and onboard electronics
• Smart buildings: automation systems, access control and connected building management solutions
• Edge AI: intelligent vision systems, AI-powered devices and data-processing platforms

The exact applicability depends on the product, its intended purpose and any relevant sector-specific regulatory exclusions.

But there is one particularly important point:

Using a third-party embedded module or computing platform does not automatically make your final product CRA-compliant.

If your company integrates an embedded system into a commercial product and places that final product on the European market under its own name or trademark, it will generally be responsible for demonstrating compliance with the applicable CRA requirements.

That is why choosing the right embedded technology partner matters more than ever.

 

What Will Change for Your Products?

The CRA introduces cybersecurity requirements covering both product development and post-market maintenance.

For companies integrating embedded technology into their solutions, several aspects deserve particular attention.

 

Security Must Be Built into Your Product

Cybersecurity should be considered from the earliest development stages.

The embedded platform, operating system and software architecture must support appropriate protection against unauthorized access, tampering and malicious software.

Capabilities such as Secure Boot, system hardening and data encryption can provide essential building blocks for achieving these objectives.

 

Your Product Must Be Maintainable and Updatable

Many industrial products remain in operation for years, sometimes in remote or difficult-to-access locations.

Under the CRA, manufacturers must establish appropriate procedures for handling vulnerabilities and providing security updates during the required support period.

This makes reliable software update mechanisms especially important.

Your product should be capable of receiving security patches without compromising operational reliability.

 

You Need Visibility into Software Vulnerabilities

Even if your company develops its own applications, the embedded system running underneath them may contain numerous open-source components and third-party software packages.

Knowing which components are included in your product, identifying known vulnerabilities and managing the associated risks are essential steps toward CRA readiness.

Software Bills of Materials (SBOMs), vulnerability assessments and traceable build processes can help support these activities.

 

Security Becomes a Long-Term Responsibility

Delivering a secure product is only the beginning.

Manufacturers must be able to respond to newly discovered vulnerabilities, maintain appropriate security documentation and manage updates throughout the applicable support period.

For businesses developing industrial products with long lifecycles, this represents a significant organizational and technical challenge.

 

Why Your Embedded Platform Matters More Than Ever

When choosing an embedded module or computing platform, performance, power consumption, dimensions, connectivity and lifecycle availability have traditionally been key selection criteria.

Today, cybersecurity capabilities and long-term software maintainability must become equally important.

An embedded platform that supports secure startup, protected storage, traceable software builds and reliable updates can significantly simplify the implementation of cybersecurity measures in the final product.

Conversely, addressing these requirements late in the development process may require substantial software modifications, additional validation and unexpected engineering costs.

For companies already using Engicam embedded solutions, this creates an opportunity to strengthen their products' cybersecurity architecture while benefiting from Engicam's hardware and software expertise.

 

Meet ATENYS: Helping You Build Secure Embedded Products

At Engicam, we understand that integrating cybersecurity into an embedded product can be complex.

That is why we developed ATENYS, our security-focused Yocto-based solution designed to help companies build more secure embedded Linux products and support their journey toward CRA readiness.

ATENYS brings together advanced security capabilities within a hardened embedded Linux environment, helping reduce the complexity of implementing important cybersecurity mechanisms.

• Secure Boot: Protect Your Product from Unauthorized Software

ATENYS supports a verified boot chain to help ensure that only trusted and authenticated firmware is executed.

This protects the integrity of the embedded software environment and helps reduce the risk of unauthorized modifications.

• A/B Updates: Keep Your Devices Secure and Operational

ATENYS integrates RAUC-based A/B update mechanisms, allowing firmware updates to be deployed with rollback capabilities.

For industrial equipment, remote devices and connected systems, this means security patches can be implemented more reliably, reducing the risk of device failures during updates.

• CVE Inspection: Identify Vulnerabilities Earlier

ATENYS integrates tools for detecting known Common Vulnerabilities and Exposures (CVEs) within the embedded software stack.

This helps development teams identify potential risks, prioritize remediation activities and improve visibility into the security of their Linux-based products.

• Storage Encryption: Protect Sensitive Data

Integrated storage encryption capabilities help safeguard confidential information, credentials and other sensitive data stored on the device.

This is particularly important for connected equipment deployed in industrial or physically accessible environments.

• Software Traceability: Support Your Compliance Documentation

Built on the Yocto Project, ATENYS benefits from tools and workflows that support component traceability, reproducible builds and SBOM generation.

These capabilities help manufacturers collect technical information relevant to security risk assessments and CRA compliance documentation.

 

Engicam and ATENYS: More Than an Embedded Hardware Supplier

Preparing for the CRA is not simply about adding security software to an existing device.

It requires a coordinated approach between hardware, operating system, applications and long-term product maintenance.

With Engicam and ATENYS, you can rely on a partner that understands both embedded hardware and embedded Linux security.

Our expertise can help you:

• Integrate security mechanisms into your embedded platform
• Implement secure firmware boot and update processes
• Assess vulnerabilities in the embedded Linux software stack
• Improve software traceability and technical documentation
• Prepare your product's embedded software architecture for upcoming cybersecurity requirements

ATENYS provides valuable technical capabilities to support CRA readiness, while formal compliance assessment and certification obligations, where applicable, remain the responsibility of the final product manufacturer.

 

December 2027 Is Approaching. The Time to Act Is Now.

The Cyber Resilience Act represents a major change for companies developing products with embedded technology.

With the main requirements becoming applicable on December 11, 2027, manufacturers have limited time to assess their current products, identify cybersecurity gaps, and implement appropriate measures.

Cybersecurity should not be treated as a last-minute compliance exercise.

By selecting embedded solutions that support secure development, vulnerability management and long-term maintenance, companies can make the transition more manageable and reduce the risk of costly redesigns.

The right embedded technology partner can make the difference between reacting to new regulations and being prepared for them.

 

Make Your Embedded Product CRA-Ready with Engicam and ATENYS
Are you developing a connected industrial product, an intelligent device or a Linux-based embedded solution?

Now is the time to evaluate how the Cyber Resilience Act could affect your product and what you can do to prepare.

Discover ATENYS, Engicam's secure embedded Linux solution, and find out how we can support your cybersecurity strategy.

Learn more at www.atenys.eu

Contact Engicam to discuss your project and start preparing for December 2027.