EU Cyber Resilience Act
CRA compliance for embedded software and firmware
Embedded software and firmware in connected products are in scope for the Cyber Resilience Act. The challenge is usually evidence over long lifecycles: an accurate firmware SBOM, secure updates, and ongoing vulnerability monitoring.
Microprocessors and microcontrollers can themselves be “important”
Annex III, Class I lists microprocessors and microcontrollers with security-related functionality, and application-specific integrated circuits (ASICs) or FPGAs with security-related functionality, as important products in their own right — separate from whatever end product they ship in. If you manufacture the chip or module rather than just the end device, check whether your own component is separately in scope.
SBOM for firmware, not just source
The same firmware-SBOM problem that affects consumer IoT applies here, often more acutely: cross-compiled toolchains, vendor board-support packages, and binary blobs from silicon vendors rarely show up in a source-level dependency manifest. Scan the actual build artifact — the image that ships — to get an SBOM that reflects what's really running.
Secure boot and update paths over long device lifetimes
Embedded products are often supported for years after the last unit ships, which makes two Annex I properties structural rather than optional: a secure update mechanism (Part I, (2)(c)) that can realistically be maintained for the product's whole support period, and integrity protection for firmware and configuration (Part I, (2)(f)) — typically some form of secure boot or signed-firmware verification.
What to focus on
- Check whether your chip or module itself is separately listed in Annex III.
- Generate an SBOM from the shipped firmware image, including vendor board-support packages.
- Implement secure boot or signed-firmware verification for integrity.
- Plan a support period and update path that realistically covers the device's service life.
Frequently asked questions
- Does the CRA apply to firmware?
- Yes — firmware in a connected product is part of a product with digital elements and is in scope. An accurate firmware SBOM and a secure update mechanism are central to compliance.
- Do I need a separate SBOM for firmware versus the app that talks to it?
- Yes — they're different products with different components. Generate an SBOM against each build artifact you ship: the firmware image and any companion application.
General information about the EU Cyber Resilience Act — not legal advice. Normproof provides tooling and audit-ready evidence; the manufacturer self-declares conformity. For your specific product, run the free readiness check or consult a qualified advisor.