The full requirements of the EU Cyber Resilience Act (CRA) will not take effect until the end of 2027, but the first milestone became active on September 11, 2026. This initial rollout requires original equipment manufacturers (OEMs) of connected electronic products in consumer, commercial and industrial markets to report severe security incidents and exploited vulnerabilities.
As OEMs implement their initial CRA compliance programs, they must evaluate the necessary supplier changes, engineering redesigns, validation activities and process improvements that will eventually be mandated. Compliance will require considerable time and effort, with OEMs ultimately responsible for ensuring their completed vehicles or machines meet regulations.
With roughly [14] months of lead time, OEMs should use this period to evaluate supply chains, product development practices, and long-term cybersecurity capabilities.
Start with Supplier Readiness
Although OEMs bear final responsibility, partnering with CRA-compliant suppliers offers the most effective solution to meeting the new and forthcoming rules. However, replacing component suppliers is rarely simple. It typically involves a qualification assessment, product redesigns to accommodate the new component, optimizing systems, additional component integration effort, and completing validation phases.
Because these tasks can take months or years, starting supplier evaluation is one of the most pragmatic steps a manufacturer can initiate today. Supplier readiness will directly impact the complexity of overall compliance efforts, as this preparation can significantly reduce the challenges OEMs will soon face at the vehicle- or equipment-level.
To begin evaluations, OEMs should ask their current or prospective suppliers the following questions:
- Is the supplier updating their own products to meet CRA requirements?
- What cybersecurity capabilities is the supplier incorporating into its products?
- How does the supplier identify and manage cybersecurity vulnerabilities or incidents?
- How will the supplier provide ongoing cybersecurity updates to help OEMs stay compliant?
Collaborating with compliant, trusted partners on solutions before future deadlines will enable exploration of more opportunities and produce more effective programs. Conversely, if an OEM partners with noncompliant suppliers, it may need to invest additional engineering resources to address cybersecurity gaps once the full CRA takes effect.
Build Security into Product Design from Day One
CRA compliance forces OEMs and partners to fundamentally reassess cybersecurity for their various platforms. As interconnectedness grows and AI and other technologies advance, cybersecurity can no longer remain an afterthought or an optional feature for industrial vehicles and machines. Instead, the CRA is accelerating the shift toward security-by-design, integrating cybersecurity controls and related considerations at all levels of design and engineering.
Today, security must be embedded in the architecture starting from the earliest development phases. This influences hardware design, cryptographic key management, firmware integrity, manufacturing processes and product provisioning and deployment.
For a pragmatic example of why cybersecurity must be integrated so early and thoroughly, consider charging systems. Secure chargers must not only charge batteries correctly, protect battery health, and support safe operation; they must also protect the software and firmware responsible for these critical functions.
Moreover, connected products like chargers do not operate in isolation but communicate with battery management systems (BMS), batteries and other vehicle systems via on-board networks, such as CAN bus. If a charger or other component is compromised, the risk of malicious or incorrect communications extends to other systems and components connected to the same network. Motor controllers, steering systems, braking systems and more might become affected or accessible, introducing additional cyberthreats or safety risks.
This adds significant complexity for engineers at OEMs and suppliers, since securing each component alone is not enough. Extensive supplier collaboration will be needed to assess and ensure individual systems and components contribute to the security of the entire machine.
Prepare for Continuous Cybersecurity Management
Beyond mandating compliance during design and manufacturing, the CRA will require OEMs to continue meeting the new cybersecurity responsibilities long after product launches and sales. No matter how well-designed a given product is, it can still develop vulnerabilities over time. Threats evolve, software becomes more complex and cybersecurity experts often must react to emerging exploits and incidents.
To extend vulnerability management requirements throughout product lifecycles, OEMs must develop effective mitigation and response programs. This generally involves initial discovery and reporting, assessing and triaging risks, developing patches and fixes, and then deploying firmware and software updates into the field.
Moving forward, supplier assessments should prioritize cybersecurity maturity alongside the more traditional factors of performance, quality and cost. To assess cybersecurity maturity, OEMs should evaluate their partners’ and their own ability to consistently identify, assess, communicate and resolve security issues.
This shift toward continuous improvement may be challenging for some OEMs. Unlike the on-road automotive industry, where regular platform updates and evolving technology requirements are the norm, off-highway OEMs have traditionally relied on longer product cycles and less frequent design changes. As equipment becomes increasingly connected, those that embrace ongoing product evolution, cybersecurity enhancements, and lifecycle support will be better positioned to become market leaders.
Transform CRA Compliance into an Opportunity
OEMs that begin preparing today will be better positioned to meet future CRA requirements while reducing the cost, risk and complexity of compliance. As connected equipment becomes increasingly software-driven and interconnected, cybersecurity can no longer be treated as a one-time design consideration or regulatory requirement. Instead, it must become an ongoing capability that spans product development, supplier management and lifecycle support. The organizations that make this transition early will be best positioned to meet evolving requirements and maintain a competitive advantage.
Author: Steven VanWerkhoven, Principal Engineer, Power Electronic Systems and Controls, Delta-Q Technologies, a ZAPI GROUP company
