The CRA and your ICT suppliers

The CRA is being introduced in stages. Since September 2026, manufacturers of in-scope products have had to report actively exploited vulnerabilities and serious incidents to EU authorities. From December 2027, products placed on the EU market will need to meet security requirements by design, receive security updates throughout a defined support period, and carry the CE marking.

For firms that already manage ICT third-party risk under DORA, this is relevant on two fronts.

First, the CRA gives firms a useful reference point when assessing suppliers. Does a vendor's product meet CRA requirements? What support period has been committed to? How will vulnerabilities be communicated? These are reasonable questions to include in due diligence and contract discussions.

Second, the line between buyer and manufacturer isn't always clear. A firm that customises, rebrands or distributes a supplier's software to its own clients may take on CRA responsibilities of its own.

For most firms, a sensible first step is a short review:
→ Which client-facing products, if any, could be in scope?
→ Which suppliers' products do we depend on?
→ Do our contracts and oversight processes reflect the CRA?

Much of the groundwork may already exist within your DORA framework. The question is how well the two connect.

If you'd like to explore how the CRA fits into your existing approach, we'd welcome the conversation.