Executive Compliance Guide: Cyber Resilience Act


Ihmiset Osaaminen Palvelut Rahoitusoikeus Kilpailuoikeus, Kauppa ja Ulkomaiset Investoinnit Rakentaminen Yrityskauppapalvelut Yritysrikokset Tietosuoja, tietoturva ja teknologia Työoikeus Rahoituspalvelujen sääntely Heinonen Vakuutusoikeus Immateriaalioikeudet Riidanratkaisu Yksityishenkilöjuridiikka Kiinteistöt Sopimusoikeus Vero-oikeus Toimialat Kuluttajapalvelut Kuluttajapalvelut Hospitality and Leisure Luxury Energia Energia Hydrogen Rahoitus Julkissektori Teollisuus Terveysteknologia ja terveydenhuolto Kiinteistöt Teknologia, media ja telekommunikaatio Teknologia, media ja telekommunikaatio Digital Infrastructure Ajankohtaista Julkaisut Asiakastyökalut Tapahtumat ja koulutukset Puheenaiheet Yritys Meistä Firm leadership Arvot Responsible business Yhteisö Monimuotoisuus ja osallisuus Ympäristövastuu Pro bono Reports Uutiset Urapolku Ura Hakemukset Miksi valita meidät? Juristit ja osakkaat Hallinnon ammattilaiset Opiskelijat ja vastavalmistuneet Toimistot Suomi Kansainväliselle sivustolle Valitse paikallinen sivusto Aasia Alankomaat Angola Arabiemiirikunnat Belgia Bulgaria Espanja Etelä-Afrikka Globaali Irak Irlanti Iso-Britannia Italia Itävalta Jordania Latvia Liettua Luxemburg Mauritius Mosambik Portugali Puola Qatar Ranska Romania Ruotsi Saksa Saudi-Arabia Slovakia Suomi Sveitsi Tšekki Tunisia Unkari Viro Yhdysvallat Muu maailma fi Valikko English Executive Compliance Guide: Cyber Resilience Act \| Navigating EU Law Etusivu Ajankohtaista Julkaisut Etusivu Ajankohtaista Julkaisut Executive Compliance Guide: Cyber Resilience Act Executive Compliance Guide: Cyber Resilience Act Navigating EU Law 02. heinäkuuta 2026 Globaali Globaali Globaali The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for connected hardware and software products sold in the EU. It requires manufacturers, importers, and distributors to embed security throughout the product lifecycle, manage vulnerabilities, report serious incidents, and demonstrate compliance through CE marking. Since its entry into force on 10 December 2024, the CRA has been reinforced by additional EU actions, including: Technical standards to help businesses implement and demonstrate compliance with the CRA's cybersecurity requirements Identification of higher-risk digital products that will be subject to stricter conformity assessment and compliance requirements The Digital Omnibus proposal, published in November 2025, to streamline incident reporting under the CRA, NIS2, and GDPR Guidance clarifying the CRA’s application to open-source software, remote data processing, support periods, and overlap with other EU rules Eversheds Sutherland takes all reasonable care to ensure that the materials, information and documents, including but not limited to articles, newsletters, reports and blogs (""Materials"") on the Eversheds Sutherland website are accurate and complete. However, the Materials are provided for general information purposes only, not for the purpose of providing legal advice, and do not necessarily reflect the present law or regulations. The Materials should not be construed as legal advice on any matter. The Materials may not reflect the most current legal developments. The content and interpretation of the Materials and the law addressed in the Materials are subject to revision. No representation or warranty, express or implied, is made as to the accuracy or completeness of the Materials and therefore the Materials should not be relied upon. Eversheds Sutherland disclaims all liability in respect of actions taken or not taken based on any or all of the contents of the Materials to the fullest extent permitted by law. The Materials are not intended to be comprehensive or to include advice on which you may rely. You should always consult a suitably qualified Lawyer/Attorney on any specific legal matter. Any views expressed through the Materials are the views of the individual author and may not reflect the views of Eversheds Sutherland or any other individual Lawyer/Attorney. Guides and Reports Navigating EU Law Palvelut Immateriaalioikeudet Tietosuoja, tietoturva ja teknologia Yrityskauppapalvelut Toimialat Julkissektori Kuluttajapalvelut Teknologia, media ja telekommunikaatio Pinnalla / Puheenaiheet Navigating EU Law Yhteyshenkilöt Olaf van Haperen Partner Rotterdam, Netherlands Caroline Lyannaz Partner Pariisi, France Nils Müller Partner München, Saksa \| Hampuri, Saksa Robbert Santifort Partner Rotterdam, Netherlands Maarten Stassen Partner Bryssel, Belgia Joanna Kulewska Knowledge Lawyer Bryssel, Belgia Uusimmat Artikkelit legal updates legal updates legal updates legal updates Uusimmat Uutiset asiakasuutiset Advising Johnson Matthey on completion of the sale of its Catalyst Technologies business to Honeywell asiakasuutiset Setting sail: Eversheds Sutherland advises senior management of D-Marin on acquisition by InfraVia toimistomme uutiset asiakasuutiset Uusimmat Tapahtumat ja koulutukset etätapahtuma \| September 10, 2026 UAE - Employment law in the Dubai International Financial Centre livetapahtuma \| September 10, 2026 Managing AI use in the workplace: what every UK HR team needs to know livetapahtuma \| September 17, 2026 livetapahtuma \| September 23, 2026 Tabs Label legal updates 27. heinäkuuta 2026 legal updates 27. heinäkuuta 2026 legal updates 24. heinäkuuta 2026 legal updates 23. heinäkuuta 2026 Lailliset huomautukset Käyttöehdot Tietosuojaseloste Evästekäytäntö Etämyynti Whistleblowing LinkedIn YouTube Sosiaalinen media Ota yhteyttä Kirjaudu asiakkaana Kirjaudu työntekijänä Tilaa Yritys Yritys Tavoitteet ja arvot Vastuullisuus Alumni Julkaisut Asiakastyökalut Tapahtumat ja koulutukset Puheenaiheet Urapolku Sivustokartta Toimistot © Eversheds Sutherland 2026. All rights reserved. Eversheds Sutherland is a provider of legal and other services operating through various separate and distinct legal entities. For further information about these entities and Eversheds Sutherlands' structure please see the Legal Notice page of this website. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client. For further information about these Eversheds Sutherland Entities and Eversheds Sutherlands’ structure please see the Legal Notices page of this website.

The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for connected hardware and software products sold in the EU. It requires manufacturers, importers, and distributors to embed security throughout the product lifecycle, manage vulnerabilities, report serious incidents, and demonstrate compliance through CE marking.

Since its entry into force on 10 December 2024, the CRA has been reinforced by additional EU actions, including:

Technical standards to help businesses implement and demonstrate compliance with the CRA's cybersecurity requirements
Identification of higher-risk digital products that will be subject to stricter conformity assessment and compliance requirements
The Digital Omnibus proposal, published in November 2025, to streamline incident reporting under the CRA, NIS2, and GDPR
Guidance clarifying the CRA’s application to open-source software, remote data processing, support periods, and overlap with other EU rules

Eversheds Sutherland takes all reasonable care to ensure that the materials, information and documents, including but not limited to articles, newsletters, reports and blogs (""Materials"") on the Eversheds Sutherland website are accurate and complete. However, the Materials are provided for general information purposes only, not for the purpose of providing legal advice, and do not necessarily reflect the present law or regulations. The Materials should not be construed as legal advice on any matter.

The Materials may not reflect the most current legal developments. The content and interpretation of the Materials and the law addressed in the Materials are subject to revision.

No representation or warranty, express or implied, is made as to the accuracy or completeness of the Materials and therefore the Materials should not be relied upon. Eversheds Sutherland disclaims all liability in respect of actions taken or not taken based on any or all of the contents of the Materials to the fullest extent permitted by law. The Materials are not intended to be comprehensive or to include advice on which you may rely. You should always consult a suitably qualified Lawyer/Attorney on any specific legal matter.

Any views expressed through the Materials are the views of the individual author and may not reflect the views of Eversheds Sutherland or any other individual Lawyer/Attorney.