If you or your customers work with connected industrial products, you've probably heard of the Cyber Resilience Act (CRA). You may know the products you choose need to comply with it. What's less clear (for most engineers and OEMs) is what that actually requires, when it kicks in, and what it means when a manufacturer says they're "CRA ready."
We'll answer all of that here. And we'll tell you exactly where Grid Connect stands.
What is the Cyber Resilience Act?
The Cyber Resilience Act is a European Union (EU) regulation that establishes mandatory cybersecurity requirements for products with digital elements - anything that can connect to a network or another device. That includes industrial networking hardware, IoT (Internet of Things) gateways, protocol converters, and the firmware that runs them.
The goal is straightforward: products should be secure by design, vulnerabilities should be disclosed and addressed, and incidents should be reported.
It applies to manufacturers, importers, and distributors who sell these products in the EU market. Which means companies based in the US still need to pay attention and comply if the equipment they build ends up in facilities or supply chains that touch the EU market, or if their customers sell into the EU.
Starting at the end of 2027, non-compliant products will not legally be able to be sold in the EU.
The CRA timeline: what's happening now and what's coming
The CRA rolls out in stages. Here's where things stand:
December 10, 2024 - The regulation entered into force. This is a legal milestone, not an operational one. It means the law officially exists, the phased deadlines are locked in, and the clock is running. Companies were not required to change any products or processes on this date, the timeline for doing so just became binding.
September 11, 2026 (now) - Active vulnerability reporting is required. This is the first real operational obligation. Manufacturers must now report actively exploited vulnerabilities in their products to the relevant national authority. "Actively exploited" is the key phrase: this applies to any confirmed active threat in a shipped product.
For those who make or import products with digital elements and sell them in the EU, this obligation is in effect today. Having a process to identify, track, and report those vulnerabilities is no longer optional.
December 11, 2027 - Full CRA compliance required. This is the deadline most engineers are focused on. All products with digital elements sold in the EU must meet the complete set of CRA requirements: security by design, documented risk assessments, patch and update mechanisms, clear lifecycle support commitments, and a software bill of materials (SBOM).
Products that don't meet these requirements by December 11, 2027 will no longer be able to be sold into the EU market.
"CRA ready" vs. "CRA certified"
You may see suppliers describe themselves as "CRA certified." That term is misleading: CRA certification, as a formal designation, does not yet exist. The conformity assessment infrastructure that will oversee CRA certification is still being established. As such, no company can be fully CRA certified today, because the process for issuing that certification is not finalized.
What companies can be, and what Grid Connect is: CRA ready. Being CRA ready means the company is actively building products and processes to meet the requirements as they come into effect, and holding existing certifications that establish a credible security baseline.
For Grid Connect, that baseline is RED-DA, the Radio Equipment Directive Delegated Act. RED-DA is the EU cybersecurity standard that applies to radio and wireless-connected equipment, and it is widely recognized as the direct precursor to CRA. Meeting RED-DA requirements means products have already undergone rigorous cybersecurity evaluation, and it positions GRID products to meet CRA requirements as full compliance comes into effect.
If a supplier tells you their products are "CRA certified" today, ask what that certification process actually consisted of. RED-DA, paired with a documented CRA readiness roadmap, is the honest and credible answer for where the industry stands right now.
What Grid Connect is doing: at the product level
For GRID-branded products, CRA-ready means building security into the hardware and firmware at a fundamental level. Here are specific examples of changes already in place or underway:
-
Password protection requirements: Default credentials have long been a known attack vector. GRID products are moving to required password setup on first use, preventing out-of-box access with factory defaults, a critical security measure that CRA explicitly addresses.
-
HTTPS over HTTP: Web-based interfaces for configuration and management are being migrated from unencrypted HTTP to HTTPS. This protects credentials and configuration data in transit, something that matters in industrial environments where network access is often broader than it should be.
-
SSH over Telnet: Remote access to device management is being updated from Telnet (an inherently insecure protocol that sends data in plain text) to SSH (Secure Shell), which encrypts the session. This is a meaningful upgrade for any environment where remote access is part of normal operations.
These updates close real attack possibilities that are specifically addressed within the CRA.
What Grid Connect is doing: at the process level
Cybersecurity compliance is not just about the hardware. The CRA imposes requirements on how products are developed, tested, documented, and maintained. Grid Connect has evaluated our process to meet these requirements:
-
Updated pre-launch requirements: All GRID products go through internal security requirements as part of the development and release process.
-
Internal audits: We have implemented structured internal audits tied to CRA requirements. This gives us a repeatable, documented process for evaluating product security and identifying gaps before they become compliance issues.
-
Vulnerability reporting processes: With the September 2026 reporting requirements now in effect, we have established processes for receiving, evaluating, and disclosing vulnerabilities.
What this means for engineers and OEMs evaluating GRID products
If you're specifying hardware for a system that will ship in or connect to the EU market, here's the practical takeaway:
New GRID-branded products are being built with CRA compliance as a design requirement. The security features being implemented now (HTTPS, SSH, password enforcement) are the kinds of requirements the CRA mandates. The internal processes being established now are what will allow Grid Connect to make documented compliance claims as December 2027 approaches.
Why cybersecurity matters beyond the regulation
It's easy to frame CRA compliance as a legal hurdle. However, the underlying risks that led to the requirements are real.
Industrial networking equipment is no longer isolated. Devices that were air-gapped five years ago are now connected to enterprise networks, cloud monitoring platforms, and remote access systems. While valuable, that connectivity creates exposure.
A compromised gateway can be a path into operational technology (OT) infrastructure. A device running on default credentials or unencrypted management interfaces is a documented vulnerability. The CRA is pushing the industry toward standards that reduce those risks because the attacks are happening, and the consequences in industrial environments can go well beyond data loss.
Building with CRA in mind is how we make sure GRID products keep earning their place in your systems for years to come.
Where we're headed
CRA readiness is an ongoing commitment. As the regulation's conformity assessment processes are finalized, and CRA certification becomes a formal option, Grid Connect will pursue appropriate certifications for GRID products.
In the meantime, we're building every new GRID product with CRA requirements in mind from the start. The goal is simple: when December 2027 arrives, GRID products are compliant - and you don't have to scramble to replace what's already in your system.
If you have specific questions about a GRID product and CRA readiness, reach out and out team will be happy to help.
