← All Terms

Cyber Resilience Act

CRA

The EU regulation setting cybersecurity requirements for products with digital elements sold in the EU, including vulnerability handling and reporting by manufacturers.

Governance & Risk

Regulation (EU) 2024/2847 entered into force on 10 December 2024. It covers hardware and software products that connect to a device or network, from smart cameras to industrial controllers, and requires manufacturers to design them securely, handle vulnerabilities across a support period and provide security updates.

Its reporting duty came first. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, including for products already on the market. The full requirements apply from 11 December 2027.

For AI built into devices, the CRA and the EU AI Act overlap. A camera with an embedded AI model is a product with digital elements under the CRA and may also be a high-risk AI system under the AI Act. Manufacturers will need to show how they handle vulnerabilities in the model as well as in the firmware around it.

Read more on this
Security

Neuromorphic AI Moves the Attack Surface Into the Device

Brain-inspired neuromorphic chips run AI as bursts of events inside sensors, cameras and controllers, and some of them keep learning after they ship. That changes cybersecurity in three ways: attackers can work through light, timing and power as well as code; the usual scanners and patches do not reach the chip; and the device you approved may not be the device in the field a year later. Maria Singh and I set out what changes, what the research already shows, and how to govern AI that adapts inside physical devices.