Many business leaders know the EU’s Cyber Resilience Act (CRA) is on the horizon.
What many don’t realise is that preparing for it isn’t something you can leave until 2027.
For companies that develop, manufacture, or sell connected products in Europe, the work starts much earlier. Security processes, documentation, vulnerability management, and product development practices all need to be in place long before the regulation becomes fully enforceable.
Recent research from the European Union Agency for Cybersecurity (ENISA) suggests that while awareness of the legislation is growing, genuine preparedness is not.
Knowing About the CRA Isn’t the Same as Being Ready
ENISA surveyed nearly 200 organisations across Europe to understand how prepared businesses are for the Cyber Resilience Act.
The findings paint a clear picture.
Around two-thirds of organisations are aware that the regulation is coming, but more than half admit they have only a limited understanding of what compliance will actually require.
In other words, businesses know the deadline exists, but many haven’t yet begun the work needed to meet it.
The Biggest Challenges
The report highlights several areas where organisations are falling behind.
Smaller businesses face the greatest challenge. More than half of micro-sized companies reported having nobody formally responsible for product cybersecurity, either internally or externally.
Many organisations also lack security practices that will become increasingly important under the CRA. Only a small proportion currently perform regular threat modelling or maintain a Software Bill of Materials (SBOM), both of which help demonstrate how software is built and what components it contains.
Perhaps most concerning is incident response. More than one in three smaller organisations said they have no formal process for responding to security vulnerabilities or cyber incidents.
For businesses hoping to achieve compliance, these aren’t minor gaps. They are foundational requirements.
Why This Matters
The Cyber Resilience Act isn’t simply another piece of paperwork.
Its goal is to improve the security of digital products sold within the European market. That means manufacturers will need to demonstrate that security has been considered throughout the product’s lifecycle, not just before release.
For many organisations, this represents a significant change in mindset.
Security is no longer something that happens at the end of a project. It becomes part of product design, development, testing, documentation, and long-term maintenance.
The businesses that begin preparing now will have a far smoother path than those waiting until the final months before enforcement.
Three Questions Every Business Should Ask
Who owns product security?
If responsibility is spread across multiple teams or left entirely to external developers, important risks can easily be overlooked. Every organisation should have clear ownership of product cybersecurity.
Can we prove how our software is built?
Documentation is becoming just as important as the software itself. Businesses need visibility into software components, vulnerabilities, and the processes used to develop secure products.
Are our security processes continuous?
Compliance won’t be achieved through a one-off audit. Organisations will need ongoing vulnerability management, regular updates, and documented security practices throughout the life of their products.
Compliance Can Be a Competitive Advantage
Regulations are often viewed as an obstacle.
In reality, businesses that prepare early often gain an advantage over competitors who leave compliance until the last minute.
Strong security processes don’t just help satisfy regulators. They build customer confidence, reduce operational risk, and make products easier to maintain over time.
The Cyber Resilience Act is approaching faster than many organisations realise. Now is the time to understand where your business stands and identify the gaps before they become barriers to selling your products.
KP Consulting helps organisations prepare for evolving cybersecurity regulations by assessing current practices, identifying compliance gaps, and building practical roadmaps that support both security and business growth.
