This book provides a clear and comprehensive overview of all the new requirements of the EU Cyber Resilience Act (CRA).

With the new CRA, the European legislator is introducing, for the first time, binding IT security requirements for the entire lifecycle of hardware and software products. Every European company that manufactures or offers physical products with digital elements and non-embedded software must be familiar with and implement these comprehensive new regulations.

In this book, the new obligations are explained in an easily understandable way, and potential pitfalls and corresponding solutions are highlighted. It looks at the scope of application, the relationship to other EU product legislation (in particular GPSR, EU Machinery Regulation, AI Act, CSA, NIS-2 Directive), formal and substantive product requirements (in particular EU declaration of conformity, CE marking, essential safety requirements), obligations of economic operators, and market surveillance and sanctions.

The book will help companies implement the regulations in their operations to ensure product-related IT compliance and avoid legal risks.