Cyber Resilience Act (CRA)
Securing Products with Digital Elements
The European Union Cyber Resilience Act (Regulation (EU) 2024/2847) introduces mandatory cybersecurity requirements for products with digital elements—encompassing both connected hardware and software. Entering into force on December 10, 2024, the regulation mandates security measures across the entire product lifecycle, emphasizing secure-by-design development, robust vulnerability management, and timely security updates.
At Qbic Technology, cybersecurity has always been a core, long-term commitment.
We are dedicated to achieving full CRA compliance across our portfolio. While the majority of our products fall under the default class and only require internal self-assessment, we choose to go further. Well ahead of the official enforcement deadlines, we proactively collaborate with UL Solutions to independently assess our engineering and operational practices. Furthermore, we apply these rigorous CRA standards globally, extending the same level of security to all our customers worldwide, not just those in the EU market.
Because Qbic views transparency as an essential cornerstone, we provide comprehensive documentation below to meet your needs.
Key Security Capabilities & Alignment
Our security architecture addresses the core essential requirements set out in the CRA, ensuring your deployments remain protected and resilient:
| Security Requirement | Implementation & Purpose |
|---|---|
| Secure Lifecycle Updates | Mechanism to deliver authenticated firmware/software patches, addressing emerging vulnerabilities without disrupting operations. |
| Access Control & Authentication | Protection against unauthorized local and remote access to secure product functionality and prevent lateral movement. |
| Data Protection at Rest & in Transit | Robust cryptographic protocols to safeguard the confidentiality and integrity of stored credentials, configurations, and network traffic. |
| Secure Boot & System Integrity | Hardware-rooted or cryptographically verified boot sequences to ensure only verified, untampered code executes. |
| Vulnerability Handling & Disclosure | Active monitoring, coordinated vulnerability disclosure (CVD), and automated patch management throughout the defined support period. |
Key CRA Milestones
| Timeline | Milestone & Impact |
|---|---|
| December 10, 2024 | Entered into Force: The regulation legally takes effect across the European Union, establishing the foundation for industry standards. |
| September 11, 2026 | Reporting Obligations Apply: Mandatory 24-hour early warning and structured notification for actively exploited vulnerabilities and severe incidents. |
| December 11, 2027 | Full Application: Complete enforcement of all essential cybersecurity requirements, CE marking, and conformity assessment procedures. |
Resources & Documentation
We are dedicated to providing our partners and customers with transparent technical documentation to simplify the path to compliance:
| Type | Title | Date |
|---|---|---|
| Assessment Report | UL Solutions Cyber Resilience Act Article 14 Assessment Report | 15 Sep 2026 |
| Attestation | UL Solutions Letter of Attestation - EU CRA Article 14 Compliance | 17 Sep 2026 |