As connected technologies continue to evolve, so does the regulatory landscape that governs them. Governments and regional bodies around the world are increasingly codifying cybersecurity expectations into law, shifting security from a product differentiator to a legal market-access requirement.

One increasingly relevant example is the European Union (EU)’s Cyber Resilience Act (CRA). Any business that sells products with digital elements in the EU will feel its effects. Its requirements drive a significant shift in how hardware and software vendors approach product security, introducing new responsibilities for semiconductor manufacturers, OEMs, technology partners, and beyond.

By understanding the CRA’s requirements now, organizations can better prepare for upcoming deadlines and strengthen their overall security posture.

What is the EU Cyber Resilience Act?
The EU Cyber Resilience Act was first introduced in late 2022 and officially entered into law in December 2024. It is a regulation designed to strengthen the cybersecurity of hardware and software products that process, store, or transmit digital data. Its scope is purposefully broad, covering everything from software applications and connected devices to semiconductors, field programmable gate arrays (FPGAs), microcontrollers, development tools, IP cores, and beyond.

At a high level, the CRA requires that digital products be:

• Secure both by design and by default.
• Protected against known vulnerabilities when brought to the market.
• Supported with processes for post-deployment vulnerability identification and remediation.
• Accompanied by clear security documentation and defined lifecycle support commitments.

The CRA also promotes greater transparency across the technology supply chain, requiring manufacturers to provide evidence that security risks are being actively managed throughout a product’s lifecycle, not simply addressed at the point of sale.

Why the CRA Matters and Why the Time to Prepare is Now
Beyond setting comprehensive security standards, the CRA fundamentally changes where cybersecurity responsibility sits. Rather than placing the burden on the end user, the CRA extends accountability throughout the hardware and software supply chain. Crucially, it applies standards directly to components, such as semiconductors, not just to finished products including autonomous robotics platforms or server rack systems.

This makes product security an increasingly important purchasing consideration for manufacturers. Any OEM that builds a device or system for the European market will need security documentation, vulnerability management commitments, lifecycle support information, and conformity evidence from component suppliers in order to complete their own CRA compliance efforts.

For those manufacturing the hardware components themselves, this creates a dual role: meeting their own regulatory responsibilities as a manufacturer while serving as a critical evidence provider for their customers.

The CRA introduces regulatory responsibilities that require establishing repeatable processes for:

• Cybersecurity risk assessments.
• Vulnerability management and disclosure.
• Security updates and defined lifecycle support commitments.
• Technical documentation and conformity evidence.

Continued cybersecurity monitoring and compliance are critical not just for user safety, but for continued access to the entire European market. What makes this especially urgent is the timeline. While the CRA entered into law in December 2024, full compliance is still ahead. But two major operational deadlines are now imminent:

• Sept. 11, 2026 – Vulnerability and incident reporting obligations begin. Manufacturers must be prepared to rapidly assess and report any actively exploited vulnerabilities and security incidents through ENISA, the European Union Agency for Cybersecurity. This includes initial reporting requirements within 24 hours of awareness, a 72-hour main notification with validated product impact and affected version details, and a final report no later than 14 days after a corrective or mitigating measure is available.
• Dec. 11, 2027 – Full CRA requirements become applicable. All covered products placed on the EU market by any global manufacturer must satisfy applicable CRA requirements, and conformity must be demonstrable. Because compliance spans product classification, risk assessments, documentation, vulnerability handling, conformity evidence, and lifecycle support planning, many manufacturers are rightly treating readiness as a multi-year program.

How Lattice is Preparing for CRA Compliance
As we get closer to full implementation of this standard, the Lattice team treats CRA compliance as an ongoing discipline rather than a one-time milestone. Lattice is executing a structured CRA readiness program that spans product security, engineering, quality, legal and compliance, and customer support. Our customers can expect the product security information, vulnerability-handling commitments, and technical documentation they need to complete their own CRA compliance when integrating Lattice devices into EU-bound systems.

In addition to these efforts, Lattice offers technologies that can help customers address CRA security objectives. Industry-leading secure FPGA devices, including the Lattice MachXO5™-NX TDQ and Lattice Mach™-NX, offer support for secure boot, hardware root of trust (HRoT), post-quantum cryptography (PQC) readiness, and Platform Firmware Resiliency (PFR). These capabilities can help customers build CRA-compliant systems that prioritize authentication, integrity, resilience, and secure firmware.

As the regulatory landscape continues to evolve, our goal is twofold: to meet our responsibilities as a semiconductor manufacturer and supplier, and to provide hardware and software solutions that enable customers to support their own CRA compliance initiatives.

Compliance as an Advantage
The EU CRA is fundamentally shifting how cybersecurity is evaluated across digital products and technology supply chains. By actively preparing to meet its requirements and continuing to invest in secure technologies, manufacturers can enable customer security while building more resilient systems for the future.

To discuss how Lattice can support your security requirements and compliance evidence needs through 2027 and beyond, visit our website and contact our team today.