EU Cyber Resilience Act (CRA)
CRA Latest Updates
Stay informed with the latest EU Cyber Resilience Act news, CRA updates, and expert publications from Applus+ Laboratories. This section brings together key regulatory developments and practical insights to help manufacturers understand what each update means for their products and compliance approach.
Applus+ Laboratories Launches CRA Self‑Assessment Questionnaire
Applus+ Laboratories has launched a new self‑assessment questionnaire to help organizations evaluate their readiness for the EU Cyber Resilience Act. The tool helps identify compliance gaps, understand cybersecurity maturity and take the first step toward a clear CRA compliance roadmap.
2025 Common Criteria & EUCC Statistics Report Released
The 2025 Common Criteria & EUCC Statistics Report by jtsec Beyond IT Security, part of Applus+ Laboratories, is now available. The report highlights 420 certifications in 2025, the dominance of protection profile–based evaluations, early EUCC adoption, and ranks Applus+ Laboratories as the world’s second largest Common Criteria evaluation laboratory.
Applus+ Laboratories Authorized by Spanish ANCC Under EUCC
Applus+ Laboratories has been authorized by the Spanish ANCC under the EUCC scheme, adding to its existing authorization by the Dutch ANCC. This milestone reinforces our role as a European reference laboratory for high-assurance ICT evaluations and strengthens our support for EUCC certification and Cyber Resilience Act readiness.
European Commission Launches CRA Guidance Public Consultation
The European Commission has opened a public consultation on draft guidance to clarify and harmonize the application of the Cyber Resilience Act, with particular attention to micro, small and medium‑sized enterprises. The guidance addresses CRA scope, support periods, regulatory overlaps and key concepts such as substantial modification.
New CRA Standards Mapping Published
Applus+ Laboratories has released a comprehensive mapping of upcoming standards under the Cyber Resilience Act. It organizes future standards by category and product type, listing available drafts, working groups, direct links and supporting resources. The document will be updated as new information becomes available.
BSI Issues New Technical Guidance on Module H Under the CRA
Germany’s Federal Office for Information Security (BSI) has published TR‑03183‑H, a technical guideline supporting the implementation of Module H (Full Quality Assurance) under the EU Cyber Resilience Act. The guidance focuses on auditing manufacturers’ cybersecurity quality management systems and aligns Module H with ISO/IEC 27001.
TIC Council CACD Meets at Applus+ to Discuss the CRA
Applus+ Laboratories is hosting the TIC Council Working Group on Connected Devices in Barcelona, bringing together experts, the European Commission and ENISA to focus on the CRA. Applus+ leaders shared insights on EUCC and CRA, reinforcing our support for European cybersecurity collaboration.
First Milestone in the transition from the RED to the CRA
The European Commission has officially adopted a delegated act to repeal the RED Cybersecurity Delegated Regulation (EU) 2022/30, with the repeal taking effect on 11 December 2027, when the Cyber Resilience Act (CRA) becomes fully applicable.
ENISA Moves Forward with the CRA Single Reporting Platform (SRP)
ENISA has published a new webpage featuring FAQs on reporting requirements and the progress in developing the Single Reporting Platform (SRP)—the central EU portal where manufacturers will report actively exploited vulnerabilities and severe cybersecurity incidents affecting products with digital elements. The SRP will become fully operational on 11 September 2026, when CRA reporting obligations officially start.
SECURE Opens First Call to Help SMEs Meet CRA Requirements
SECURE has launched its first cascade funding call, offering up to €30,000 for SMEs to strengthen cybersecurity and support CRA compliance. With €5M available, the initiative promotes secure‑by‑design, risk management and improved governance. The call remains open until 29 March 2026.
prEN 40000‑1‑3 Open for Public Comment
Draft standard prEN 40000‑1‑3, developed by CEN/CENELEC JTC 13 WG 9, is now open for public comments. This PT3 document defines horizontal requirements for vulnerability handling and coordinated disclosure processes. These requirements are essential, as vertical standards will rely on them to support CRA compliance, particularly Annex I Part I. Both remain under enquiry as of late 2025. As usual, comments can be submitted through national standards bodies, for example through UNE in Spain.
New CRA's FAQ guide
The European Commission has just released a Frequently Asked Questions (FAQ) for the Cyber Resilience Act (CRA).
EU Clarifies CRA Product Categories: New Implementing Regulation
The European Commission has published Implementing Regulation (EU) 2025/2392, which provides more detailed technical descriptions of important and critical categories of products with digital elements under the Cyber Resilience Act (CRA).
PCI PTS v7.0 Meets CRA: New Compliance Era for Payment Terminals
The arrival of PCI PTS v7.0 and the new European regulatory landscape will mark a turning point for the payment terminal industry.
ETSI Releases New CRA Draft Developments Across Key Topics 22, 24, 35 and 36
ETSI has published additional preliminary draft standards prepared by the CYBER/EUSR working group to support the EU Cyber Resilience Act. As early-stage documents still under development, they are open for public consultation ahead of their planned 2026 completion. A wide set of technical drafts is available, and stakeholders are encouraged to review them and contribute feedback via the ETSI “Open” directory.
CRA Essential Guide
The new EU regulation is set to reshape how digital products are designed, developed, and maintained.
ICCC 2025: Common Criteria
Last week, we had the pleasure of participating in the International Common Criteria Conference (ICCC 2025) in Seoul.
prEN 40000‑1‑1 and prEN 40000‑1‑2 Open for Public Comment
Draft standards prEN 40000‑1‑1 and prEN 40000‑1‑2, developed by CEN/CENELEC JTC 13 WG 9, are now open for public comments. The first defines a shared cybersecurity vocabulary, while the second sets core principles and lifecycle risk‑management requirements for products with digital elements. Both remain under enquiry as of late 2025. As usual, comments can be submitted through the national standards body, for example through UNE in Spain.
ETSI Releases New CRA Draft Developments Across Key Topics 17–20, 23, 25-27
ETSI has released a new set of preliminary draft standards developed by the CYBER/EUSR working group to support the EU Cyber Resilience Act. These early drafts, still evolving ahead of expected finalization in 2026, are now open for public consultation. A broad range of technical documents is available, and stakeholders are invited to review and provide feedback through the ETSI “Open” directory.
Cyber Resilience Act Reporting Obligations
In this article, we examine the different reporting tracks available to manufacturers when notifying CSIRT‑ENISA, depending on the nature and severity of the incident or vulnerability.
CRA and how to comply through the EUCC Certification
This article is based on Jose Manuel Pulido (Consulting Manager at jtsec) presentation during the EUCC scheme webinar organized by Applus+ Laboratories in October 2024.
Cyber Resilience Act: Implementation Status October 2025
The Cyber Resilience Act (CRA) is reshaping the cybersecurity landscape for digital products in the European Union.
EU Cyber Regulations
In an era where digital transformation is pivotal, cybersecurity has become a critical concern for businesses and governments alike.
An overview of EU's Cyber Resilience Act
The Cyber Resilience Act (CRA) is an EU cybersecurity regulation that mandates manufacturers of products with digital elements to meet specific requirements before they can be sold or provided within EU member countries.
Why these CRA latest updates matter for manufacturers and product teams
The Cyber Resilience Act is being rolled out over last years after entry into force in 2024, with key milestones leading up to its full application. For manufacturers, staying up to date with the latest EU Cyber Resilience Act news and updates is important, as each development can clarify requirements, impact timelines, and shape how cybersecurity needs to be addressed across the product lifecycle. Following these CRA updates helps teams anticipate changes, reduce uncertainty, and avoid last-minute adjustments that could delay market access or increase compliance effort.
How the CRA is evolving and what to watch next
The Cyber Resilience Act continues to evolve as standards, guidance, and implementation details are progressively defined. Manufacturers should closely monitor EU Cyber Resilience Act news and CRA updates related to the development of harmonized standards, clarifications on product categories and CRA compliance routes, updates on reporting obligations and key deadlines, and progress of certification schemes and conformity assessment requirements. As the regulatory framework matures, early visibility into these changes is essential to align product development and compliance strategies in advance.
How Applus+ Laboratories can help you stay up to date with the CRA
Applus+ Laboratories supports manufacturers in navigating the latest EU Cyber Resilience Act updates today by combining regulatory insight with technical cybersecurity expertise. Our teams continuously monitor CRA developments, standards evolution, and regulatory discussions, helping you understand what is changing and how it impacts your products. Beyond staying informed, we help translate each CRA update into concrete actions — from readiness assessments and gap analysis to certification and conformity assessment — ensuring you remain aligned with the evolving requirements.