The Cyber Resilience Act (CRA) will soon impose new cybersecurity requirements on hardware and software manufacturers in the EU. Prices of affected components are already rising, and experts warn that the era of cheap but insecure products is over. The first obligations, including reporting actively exploited vulnerabilities, take effect on 11 September 2026.
During a panel at CYBERSEC EXPO & FORUM 2026, industry leaders discussed the impact of the regulation. Andrzej Dulka, president of the Polish Chamber of Information Technology and Telecommunications, stressed that security comes at a price. „If we thought security was free or that the government or a big ally would protect us, we now understand that’s not the case. We have to take care of our own security, and as a society we have to pay for it.”
Andrzej Bartosiewicz, founder of the CISO #Poland Foundation, noted that the market is already responding. „We see price movements. The costs of components subject to CRA, such as PLC controllers, are already rising. We know they will become significantly more expensive.”
New obligations for manufacturers
CRA requires that almost all products with digital elements – from software to IoT devices – be secure by design and free of known vulnerabilities. Manufacturers must monitor and patch flaws throughout the product’s lifecycle. Products will carry a „CE” mark, and companies must publicly state the support period, typically at least five years.
Mikołaj Śniatała, partner at Andersen, recalled the case of a speaker brand that suddenly shut down its cloud services. „We had a speaker but no streaming, no multiroom. So what is a connected product today?” He warned that manufacturers must be transparent about how long a product will be supported.
Rising costs and certification challenges
The regulation also forces producers to report actively exploited vulnerabilities to a single EU platform managed by ENISA. Krzysztof Silicki, director for strategic development of cybersecurity at NASK, said the system will be ready on time. „At the beginning I don’t expect a huge wave of reports, but it will grow. Reporting only actively exploited vulnerabilities is intentional. If we reported everything, AI models would find flaws automatically and we’d face an Armageddon.”
However, some experts voiced concerns about certification timelines. Andrzej Bartosiewicz argued that CRA’s certification model suits products from the 1980s, not modern software released every three months. Aleksandra Wójtowicz from the Polish Institute of International Affairs countered: „The first cycle is long, but later it becomes easier. Many products share common components – the more we certify, the simpler it gets.”
A missing piece of the cybersecurity puzzle
Kinga Pawłowska-Nojszewska, a legal advisor, noted that much attention is still focused on the NIS2 directive, while CRA remains overlooked. „Only the largest companies have started thinking about CRA. Polish government has not yet designated the responsible bodies.”
Krzysztof Silicki described CRA as „the missing link in the evolution of cybersecurity.” He explained that while NIS2 puts obligations on operators, it doesn’t cover product manufacturers. „Now we close that gap.”
Jarosław Homa, cybersecurity plenipotentiary at the Silesian University of Technology, welcomed the regulation. „After 11 December 2027, only secure products will be allowed. We will stop using random solutions.” Yet he admitted challenges for universities, which often rely on student-built software.
Not all obligations are costly, Silicki pointed out. „IoT devices shipped with default passwords like 'admin, admin’ – that can be fixed with a simple setup procedure. The cost is minimal.”
Źródło: WNP.PL, Fot. PTWP
