Understanding the EU Cyber Resilience Act (CRA) and Renesas’ Commitment to Compliance

Regulation of Products with Digital Elements

The European Union Cyber Resilience Act (CRA) aims to safeguard personal and business consumers from cybersecurity threats, focusing on software and hardware products with digital elements. The CRA went into effect on Dec. 10, 2024 and requires security measures throughout a product's entire lifecycle. It emphasizes secure development processes, the ability to address vulnerabilities through updates, and mechanisms to remove personal information when necessary. The main requirements of the CRA go into effect on Dec. 11, 2027.

We support CRA compliance in two key ways. Many of our devices are directly subject to CRA regulations, and many others are integrated into hardware products that fall under these regulations. Our longstanding dedication to security means that numerous products have already been designed, developed, and manufactured in alignment with CRA objectives. As the CRA standards are finalized, we will ensure our products achieve full compliance within the designated enforcement timeline.

Renesas is committed to helping you find the resources you need as you work toward CRA compliance. From documentation and design resources to our network of security solution providers, we offer tools to help you understand what the CRA means for your products. Refer to this page for updates on how we are working to support CRA requirements.

CRA Requirements

CRA requirements seek to enhance security for digital products in several ways, each with a specific purpose.

	CRA Requirement	Purpose
Image	Secure Firmware Updates	Address security vulnerabilities and maintain up-to-date protection against the latest threats.
Image	Unauthorized Access Protection	Protect the operation and behavior of products and their associated data.
Image	Secure Data Storage	Protect the confidentiality and integrity of stored data.
Image	Secure Communication	Protect the confidentiality and integrity of transmitted data.
Image	Secure Boot	Protect product operation and behavior.

It is important to reference official sources to determine CRA requirements as they pertain to your specific products and applications.

European Commission Cyber Resilience Act
Official Journal of the European Union – the official text of the Cyber Resilience Act

CRA Important Dates

Date	Description
December 10, 2024	CRA takes effect. The Act has legal existence in the European Union legal order as of this date. It serves as the starting point for the enforcement timelines that are specified in the Act.
September 11, 2026	All manufacturers of products with digital elements are required to report vulnerabilities and security incidents contained in their products.
December 11, 2027	CRA is fully enforceable, and all its requirements must be complied with by manufacturers of products with digital elements.

Documentation

Downloads

Partner Solutions

Starting out in cybersecurity and trying to build a CRA-compliant product can feel overwhelming. The Renesas Partner Program is an extensive and curated network of top security solution providers who know how to make the most of our device security features to meet CRA requirements.

Renesas Partner Program

Videos & Training

Sixth in the RX security video series – Renesas walks through the process of encrypting the application program and performing a Secure Firmware Update using the Renesas Secure Flash Programmer so that the plain text of the application program to be updated is not exposed when updating the application program.