The EU CRA – Treating Cybersecurity as Product Liability

The piece analyzes the EU Cyber Resilience Act (Regulation (EU) 2024/2847) and March 2026 guidance, explaining that the CRA shifts cybersecurity responsibility upstream to manufacturers and suppliers, outlines key obligations (secure-by-design, support periods, vulnerability handling, reporting), highlights impacts across industries (consumer devices, medical devices, AI-enabled products, supply chains), and recommends immediate compliance actions such as inventorying components/SBOMs, establishing vulnerability intake and support processes, and clarifying internal ownership — it is regulatory analysis rather than an incident report.